Multiple format string vulnerabilities in the python module in RRDtool, as used in Zenoss Core before 4.2.5 and other products, allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted third argument to the rrdtool.graph function, aka ZEN-15415, a related issue to CVE-2013-2131.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Multiple format string vulnerabilities in the python module in RRDtool, as used in Zenoss Core before     4.2.5 and other products, allow remote attackers to execute arbitrary code or cause a denial of service     (application crash) via a crafted third argument to the rrdtool.graph function, aka ZEN-15415, a related     issue to CVE-2013-2131. (CVE-2014-6262)

Note that Nessus relies on the presence of the package as reported by the vendor.

It was discovered that there was a regression in a previous fix, which resulted in the following error :

ERROR: cannot compile regular expression: Error while compiling regular expression ^(?:[^%]+|%%)*%[+- 0#]?[0-9]*([.][0-9]+)?l[eEfF](?:[^%]+|%%)*%s(?:[^%]+|%%)*$ at char 18:
range out of order in character class (^(?:[^%]+|%%)*%[+- 0#]?[0-9]*([.][0-9]+)?l[eEfF](?:[^%]+|%%)*%s(?:[^%]+|%%)*$)

For Debian 8 'Jessie', this problem has been fixed in version 1.4.8-1.2+deb8u2.

We recommend that you upgrade your rrdtool packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Versions of Zenoss prior to 4.2.5 are unpatched and potentially affected by multiple vulnerabilities : 

  - Prone to a cross-site request forgery that could be used to trick a user into changing their password.(ZEN-12653)

  - A stored cross-site scripting vulnerability on pages which display device names and details.(ZEN-15381)

  - Multiple information-disclosure vulnerabilities due to the stack trace returning sensitive information when renaming a product with special characters.(ZEN-15382)

  - An open redirect vulnerability exposed in the login form.(ZEN-11998)

  - Remote code execution vulnerability which can occur via Version Check.(ZEN-12657)

  - Authorization Bypass allowing an attacker to move or execute files on the server remotely.(ZEN-15386)

  - A cross-site request forgery which leads to ZenPack installation at time of server boot.(ZEN-15388)

  - Login sessions to Zenoss do not expire.(ZEN-12691)

  - Information Disclosure permitting unprivileged users to list all users of Zenoss.(ZEN-15389)

  - Multiple logon vulnerabilities due to insecure password hashing, low complexity requirements, and plaintext credential storage on the server.(ZEN-15413, ZEN-15406, ZEN-15416, ZEN-10148)

  - Authorization bypass exists in Zope web platform invoked through as web endpoints through numerous helper methods.(ZEN-15407)

  - Unnecessary exposed services in default Zenoss configuration.(ZEN-15408)

  - Several stored and reflected cross-site scripting vulnerabilities due to the way data is displayed on asset detail pages.(ZEN-15410)

  - Denial of Service vulnerability on a publicly accessible endpoint of Zenoss to specify an exhaustive regex which could render the application inaccessible.(ZEN-15411)

  - Page Command for sysadmins via Zenoss can be edited without password re-entry.(ZEN-15412)

  - "Billion Laughs" Denial of Service vulnerability which can result in remote code execution.(ZEN-15414, ZEN-15415)

ID	Name	Product	Family	Type	Severity
253831	Linux Distros Unpatched Vulnerability : CVE-2014-6262	Nessus	Misc.	Local	high
134182	Debian DLA-2131-2 : rrdtool regression update	Nessus	Debian Local Security Checks	Local	high
8594	Zenoss < 4.2.5 Multiple Vulnerabilities	Nessus Network Monitor	CGI		high

Detections

Analytics

CVE-2014-6262

high

Tenable Plugins

high

high

high