Nagios Network Analyzer < 2.2.2 Multiple Vulnerabilities

Critical Nessus Network Monitor Plugin ID 9602

Synopsis

The remote host is running a version of Nagios Network Analyzer that is affected by multiple attack vectors.

Description

Versions of Nagios Network Analyzer prior to 2.2.2 are vulnerable to the following issues :

- A flaw exists as HTTP requests to '/nagiosna/index.php/api/system/create_command' do not require multiple steps, explicit confirmation, or a unique token when performing certain sensitive actions. By tricking a user into following a specially crafted link, a context-dependent attacker can perform a Cross-Site Request Forgery (CSRF/XSRF) attack causing the victim to execute arbitrary commands. (OSVDB 142777)
- A flaw exists that allows a reflected cross-site scripting (XSS) attack. This flaw exists because the '/nagiosna/index.php/sources/queries' script does not validate input to the 'q[qid]' parameter before returning it to users. This may allow a context-dependent attacker to create a specially crafted request that would execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server. (OSVDB 142778)
- A flaw exists as HTTP requests to '/nagiosna/index.php/admin/users/create' do not require multiple steps, explicit confirmation, or a unique token when performing certain sensitive actions. By tricking a user into following a specially crafted link, a context-dependent attacker can perform a CSRF/XSRF attack causing the victim to create administrative users. (OSVDB 142779)
- A flaw exists as HTTP requests to '/nagiosna/index.php/api/reports/delete' do not require multiple steps, explicit confirmation, or a unique token when performing certain sensitive actions. By tricking a user into following a specially crafted link, a context-dependent attacker can perform a CSRF/XSRF attack causing the victim to delete reports. (OSVDB 142780)
- A flaw exists as HTTP requests to '/nagiosna/index.php/api/system/stop' do not require multiple steps, explicit confirmation, or a unique token when performing certain sensitive actions. By tricking a user into following a specially crafted link, a context-dependent attacker can perform a CSRF/XSRF attack causing the victim to stop services. (OSVDB 142781)
- A flaw exists as HTTP requests to '/nagiosna/index.php/admin/users/delete' do not require multiple steps, explicit confirmation, or a unique token when performing certain sensitive actions. By tricking a user into following a specially crafted link, a context-dependent attacker can perform a CSRF/XSRF attack causing the victim to delete arbitrary users. (OSVDB 142782)
- A flaw exists that may allow carrying out an SQL injection attack. The issue is due to the '/nagiosna/index.php/api/checks/read' script not properly sanitizing input to the 'o[col]' parameter. This may allow a remote attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data. (OSVDB 143164)
- A flaw exists that may allow carrying out an SQL injection attack. The issue is due to the '/nagiosna/index.php/api/sources/read' script not properly sanitizing input to the 'o[col]' parameter. This may allow a remote attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data. (OSVDB 143165)
- A flaw exists that may allow carrying out an SQL injection attack. The issue is due to the '/nagiosna/index.php/admin/globals' script not properly sanitizing input to the 'timezone' parameter. This may allow a remote attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data. (OSVDB 143166)
- A flaw exists in '/nagiosna/index.php/download/report/sourcegroup/' that is triggered as user-supplied input is not properly sanitized. This may allow a remote attacker to execute arbitrary commands. (OSVDB 143167)
- A flaw exists in '/nagiosna/index.php/download/report/source/' that is triggered as user-supplied input is not properly sanitized. This may allow a remote attacker to execute arbitrary commands. (OSVDB 143168)
- A flaw exists that is due to the program setting insecure permissions for the '/usr/local/nagiosna/bin/rc.py' file. This may allow a local attacker to gain elevated privileges. (OSVDB 143169)
- A flaw exists that is due to the program setting insecure permissions for the '/usr/local/nagiosna/scripts/change_timezone.sh' file. This may allow a local attacker to gain elevated privileges. (OSVDB 143170)
- A flaw exists that is due to the program setting insecure permissions for the '/usr/local/nagiosna/scripts/upgrade_to_latest.sh' file. This may allow a local attacker to gain elevated privileges. (OSVDB 143171)

Solution

Upgrade Network Analyzer to version 2.2.2 or later.

See Also

https://assets.nagios.com/downloads/nagios-network-analyzer/CHANGES.TXT

Plugin Details

Severity: Critical

ID: 9602

Family: CGI

Published: 2016/09/30

Modified: 2016/12/06

Dependencies: 9601

Risk Information

Risk Factor: Critical

CVSSv2

Base Score: 10

Temporal Score: 8.3

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Temporal Vector: CVSS2#E:F/RL:OF/RC:C

CVSSv3

Base Score: 9.8

Temporal Score: 9.1

Vector: CVSS3#AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS3#E:F/RL:O/RC:C

Vulnerability Information

Patch Publication Date: 2016/07/22

Vulnerability Publication Date: 2016/08/11