An issue was discovered in Icinga 2.x through 2.8.1. By sending specially crafted messages, an attacker can cause a NULL pointer dereference, which can cause the product to crash.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An issue was discovered in Icinga 2.x through 2.8.1. By sending specially crafted messages, an attacker     can cause a NULL pointer dereference, which can cause the product to crash. (CVE-2018-6534)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - An issue was discovered in Icinga 2.x through 2.8.1. By sending specially crafted (authenticated and
    unauthenticated) requests, an attacker can exhaust a lot of memory on the server side, triggering the OOM
    killer. (CVE-2018-6532)

  - An issue was discovered in Icinga 2.x through 2.8.1. By sending specially crafted messages, an attacker
    can cause a NULL pointer dereference, which can cause the product to crash. (CVE-2018-6534)

  - An issue was discovered in Icinga 2.x through 2.8.1. The lack of a constant-time password comparison
    function can disclose the password to an attacker. (CVE-2018-6535)

ID	Name	Product	Family	Severity
258012	Linux Distros Unpatched Vulnerability : CVE-2018-6534	Nessus	Misc.	medium
404923	Alpine: multiple icinga2 packages: security update to 2.8.2-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
404923	Alpine: multiple icinga2 packages: security update to 2.8.2-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
400712	Alpine: multiple icinga2 packages: security update to 2.8.1-r0 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	high
400712	Alpine: multiple icinga2 packages: security update to 2.8.1-r0 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high

Detections

Analytics

CVE-2018-6534

medium

Tenable Plugins

medium

high

high

high

high