Mandriva Linux Security Advisory : munin (MDVSA-2013:297)

Medium Nessus Plugin ID 71605


The remote Mandriva Linux host is missing one or more security updates.


Updated munin packages fix security vulnerabilities :

The Munin::Master::Node module of munin does not properly validate certain data a node sends. A malicious node might exploit this to drive the munin-html process into an infinite loop with memory exhaustion on the munin master (CVE-2013-6048).

A malicious node, with a plugin enabled using multigraph as a multigraph service name, can abort data collection for the entire node the plugin runs on (CVE-2013-6359).


Update the affected munin, munin-master and / or munin-node packages.

See Also

Plugin Details

Severity: Medium

ID: 71605

File Name: mandriva_MDVSA-2013-297.nasl

Version: $Revision: 1.2 $

Type: local

Published: 2013/12/23

Modified: 2013/12/26

Dependencies: 12634

Risk Information

Risk Factor: Medium


Base Score: 5

Temporal Score: 4.3

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P

Temporal Vector: CVSS2#E:ND/RL:OF/RC:C

Vulnerability Information

CPE: p-cpe:/a:mandriva:linux:munin, p-cpe:/a:mandriva:linux:munin-master, p-cpe:/a:mandriva:linux:munin-node, cpe:/o:mandriva:business_server:1

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/Mandrake/release, Host/Mandrake/rpm-list

Exploit Available: false

Exploit Ease: No known exploits are available

Patch Publication Date: 2013/12/20

Reference Information

CVE: CVE-2013-6048, CVE-2013-6359

BID: 64188, 64189

MDVSA: 2013:297