LinuxSecurity.com
Share your story
The central voice for Linux and Open Source security news
Home News Topics Advisories HOWTOs Features Newsletters About Register

Welcome!
Sign up!
EnGarde Community
Login
Polls
What is the most important Linux security technology?
 
Advisories
Community
Linux Events
Linux User Groups
Link to Us
Security Center
Book Reviews
Security Dictionary
Security Tips
SELinux
White Papers
Featured Blogs
All About Linux
DanWalsh LiveJournal
Securitydistro
Latest Newsletters
Linux Advisory Watch: December 12th, 2014
Linux Security Week: December 9th, 2014
Subscribe
LinuxSecurity Newsletters
E-mail:
Choose Lists:
About our Newsletters
RSS Feeds
Get the LinuxSecurity news you want faster with RSS
Powered By

  
Ubuntu: nagios-plugins vulnerability Print E-mail
User Rating:      How can I rate this item?
Posted by Benjamin D. Thomas   
Ubuntu Nobuhiro Ban discovered that check_http in nagios-plugins did not properly sanitize its input when following redirection requests. A malicious remote web server could cause a denial of service or possibly execute arbitrary code as the user.
=========================================================== 
Ubuntu Security Notice USN-532-1           October 22, 2007
nagios-plugins vulnerability
CVE-2007-5198
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 6.06 LTS

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 6.06 LTS:
  nagios-plugins                  1.4.2-5ubuntu3.1
  nagios-plugins-basic            1.4.2-5ubuntu3.1
  nagios-plugins-standard         1.4.2-5ubuntu3.1

In general, a standard system upgrade is sufficient to affect the
necessary changes.

Details follow:

Nobuhiro Ban discovered that check_http in nagios-plugins did
not properly sanitize its input when following redirection
requests. A malicious remote web server could cause a denial
of service or possibly execute arbitrary code as the user.
(CVE-2007-5198)

Aravind Gottipati discovered that sslutils.c in nagios-plugins
did not properly reset pointers to NULL. A malicious remote web
server could cause a denial of service.

Aravind Gottipati discovered that check_http in nagios-plugins
did not properly calculate how much memory to reallocate when
following redirection requests. A malicious remote web server
could cause a denial of service.


Updated packages for Ubuntu 6.06 LTS:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/n/nagios-plugins/nagios-plugins_1.4.2-5ubuntu3.1.diff.gz
      Size/MD5:    40038 2ce232319f1412bd31218e4f80f379aa
    http://security.ubuntu.com/ubuntu/pool/main/n/nagios-plugins/nagios-plugins_1.4.2-5ubuntu3.1.dsc
      Size/MD5:     1054 a0c28730ba822bef978cf7428447320a
    http://security.ubuntu.com/ubuntu/pool/main/n/nagios-plugins/nagios-plugins_1.4.2.orig.tar.gz
      Size/MD5:   973712 5ac95978cc49c35132a5a2ea1c985c20

  amd64 architecture (Athlon64, Opteron, EM64T Xeon):

    http://security.ubuntu.com/ubuntu/pool/main/n/nagios-plugins/nagios-plugins-basic_1.4.2-5ubuntu3.1_amd64.deb
      Size/MD5:   265222 1ebcbca55e85bee9e0579a98227aa5ac
    http://security.ubuntu.com/ubuntu/pool/main/n/nagios-plugins/nagios-plugins-standard_1.4.2-5ubuntu3.1_amd64.deb
      Size/MD5:   159170 62cb762bf4b953aab1cbe8a2ce5ddf33
    http://security.ubuntu.com/ubuntu/pool/main/n/nagios-plugins/nagios-plugins_1.4.2-5ubuntu3.1_amd64.deb
      Size/MD5:    64236 c67353629a02a09f5bc863dfc76311b6

  i386 architecture (x86 compatible Intel/AMD):

    http://security.ubuntu.com/ubuntu/pool/main/n/nagios-plugins/nagios-plugins-basic_1.4.2-5ubuntu3.1_i386.deb
      Size/MD5:   226406 1edb66f9f3d896f32604261ca5fc6de7
    http://security.ubuntu.com/ubuntu/pool/main/n/nagios-plugins/nagios-plugins-standard_1.4.2-5ubuntu3.1_i386.deb
      Size/MD5:   142844 665cc990cfc20064cd5df981e2836db7
    http://security.ubuntu.com/ubuntu/pool/main/n/nagios-plugins/nagios-plugins_1.4.2-5ubuntu3.1_i386.deb
      Size/MD5:    64224 23d300cb4585debe59cc7652ee8b0732

  powerpc architecture (Apple Macintosh G3/G4/G5):

    http://security.ubuntu.com/ubuntu/pool/main/n/nagios-plugins/nagios-plugins-basic_1.4.2-5ubuntu3.1_powerpc.deb
      Size/MD5:   245756 78ec9be9d3b0e6d5c2d1821d93652cc1
    http://security.ubuntu.com/ubuntu/pool/main/n/nagios-plugins/nagios-plugins-standard_1.4.2-5ubuntu3.1_powerpc.deb
      Size/MD5:   159026 f2617d51e4cfd9ee1e44c27c609eb3d3
    http://security.ubuntu.com/ubuntu/pool/main/n/nagios-plugins/nagios-plugins_1.4.2-5ubuntu3.1_powerpc.deb
      Size/MD5:    64234 abd123c2d7c19a789617a902e91857af

  sparc architecture (Sun SPARC/UltraSPARC):

    http://security.ubuntu.com/ubuntu/pool/main/n/nagios-plugins/nagios-plugins-basic_1.4.2-5ubuntu3.1_sparc.deb
      Size/MD5:   234452 167d37e690c2e8553e0cc15eca80ef89
    http://security.ubuntu.com/ubuntu/pool/main/n/nagios-plugins/nagios-plugins-standard_1.4.2-5ubuntu3.1_sparc.deb
      Size/MD5:   144714 87eaaf687549fcb4f9de76c7a33accb9
    http://security.ubuntu.com/ubuntu/pool/main/n/nagios-plugins/nagios-plugins_1.4.2-5ubuntu3.1_sparc.deb
      Size/MD5:    64232 2f26e0b30e1e06ed8f5ecfdffb16a2e0


 
< Prev   Next >
    
Partner

 

Latest Features
Peter Smith Releases Linux Network Security Online
Securing a Linux Web Server
Password guessing with Medusa 2.0
Password guessing as an attack vector
Squid and Digest Authentication
Squid and Basic Authentication
Demystifying the Chinese Hacking Industry: Earning 6 Million a Night
Free Online security course (LearnSIA) - A Call for Help
What You Need to Know About Linux Rootkits
Review: A Practical Guide to Fedora and Red Hat Enterprise Linux - Fifth Edition
Yesterday's Edition
University of California, Berkeley Hacked, Data Compromised
London teen pleads guilty to Spamhaus DDoS
New England security group shares threat intelligence, strives to bolster region
Partner Sponsor

Community | HOWTOs | Blogs | Features | Book Reviews | Networking
 Security Projects |  Latest News |  Newsletters |  SELinux |  Privacy |  Home
 Hardening |   About Us |   Advertise |   Legal Notice |   RSS |   Guardian Digital
(c)Copyright 2014 Guardian Digital, Inc. All rights reserved.