LinuxSecurity.com
Share your story
The central voice for Linux and Open Source security news
Home News Topics Advisories HOWTOs Features Newsletters About Register

Welcome!
Sign up!
EnGarde Community
Login
Polls
What is the most important Linux security technology?
 
Advisories
Community
Linux Events
Linux User Groups
Link to Us
Security Center
Book Reviews
Security Dictionary
Security Tips
SELinux
White Papers
Featured Blogs
All About Linux
DanWalsh LiveJournal
Securitydistro
Latest Newsletters
Linux Security Week: April 7th, 2014
Linux Advisory Watch: April 4th, 2014
Subscribe
LinuxSecurity Newsletters
E-mail:
Choose Lists:
About our Newsletters
RSS Feeds
Get the LinuxSecurity news you want faster with RSS
Powered By

  
Mandriva: [ MDVSA-2009:054 ] nagios Print E-mail
User Rating:      How can I rate this item?
Posted by Benjamin D. Thomas   
Mandrake A vulnerability has been identified and corrected in nagios: Cross-site scripting (XSS) vulnerability in Nagios allows remote attackers to inject arbitrary web script or HTML via unknown vectors, a different vulnerability than CVE-2007-5624 and CVE-2008-1360 (CVE-2007-5803).
 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2009:054
 http://www.mandriva.com/security/
 _______________________________________________________________________

 Package : nagios
 Date    : February 24, 2009
 Affected: Corporate 4.0
 _______________________________________________________________________

 Problem Description:

 A vulnerability has been identified and corrected in nagios:
 
 Cross-site scripting (XSS) vulnerability in Nagios allows remote
 attackers to inject arbitrary web script or HTML via unknown vectors,
 a different vulnerability than CVE-2007-5624 and CVE-2008-1360
 (CVE-2007-5803).
 
 The updated packages have been upgraded to the latest version of
 nagios to prevent this.
 _______________________________________________________________________

 References:

 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5803
 _______________________________________________________________________

 Updated Packages:

 Corporate 4.0:
 2f4eff0f154fb6b5470d1cb0fad177be  corporate/4.0/i586/nagios-3.1.0-0.1.20060mlcs4.i586.rpm
 97dd676d23af47a198b4d7d8a4a98772  corporate/4.0/i586/nagios-devel-3.1.0-0.1.20060mlcs4.i586.rpm
 19658855978419d653aa3ad103d4a202  corporate/4.0/i586/nagios-theme-default-3.1.0-0.1.20060mlcs4.i586.rpm
 a6f6d5a202d2261977fc45fb5f0cf239  corporate/4.0/i586/nagios-www-3.1.0-0.1.20060mlcs4.i586.rpm 
 810578c6a17cd25e2c4b5c08f5363111  corporate/4.0/SRPMS/nagios-3.1.0-0.1.20060mlcs4.src.rpm

 Corporate 4.0/X86_64:
 fcca43b9dfedae723b76beee215b4ae4  corporate/4.0/x86_64/nagios-3.1.0-0.1.20060mlcs4.x86_64.rpm
 f6051010aa536ff0943693e29a86dfea  corporate/4.0/x86_64/nagios-devel-3.1.0-0.1.20060mlcs4.x86_64.rpm
 485776dee99e096ce00e34a90f9b4af5  corporate/4.0/x86_64/nagios-theme-default-3.1.0-0.1.20060mlcs4.x86_64.rpm
 3eecf54904721ef8ce9fb3c75a40be66  corporate/4.0/x86_64/nagios-www-3.1.0-0.1.20060mlcs4.x86_64.rpm 
 810578c6a17cd25e2c4b5c08f5363111  corporate/4.0/SRPMS/nagios-3.1.0-0.1.20060mlcs4.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  
 
< Prev   Next >
    
Partner

 

Latest Features
Peter Smith Releases Linux Network Security Online
Securing a Linux Web Server
Password guessing with Medusa 2.0
Password guessing as an attack vector
Squid and Digest Authentication
Squid and Basic Authentication
Demystifying the Chinese Hacking Industry: Earning 6 Million a Night
Free Online security course (LearnSIA) - A Call for Help
What You Need to Know About Linux Rootkits
Review: A Practical Guide to Fedora and Red Hat Enterprise Linux - Fifth Edition
Yesterday's Edition
Heartbleed: Security experts reality-check the 3 most hysterical fears
Open source trounces proprietary software for code defects, Coverity analysis finds
Partner Sponsor

Community | HOWTOs | Blogs | Features | Book Reviews | Networking
 Security Projects |  Latest News |  Newsletters |  SELinux |  Privacy |  Home
 Hardening |   About Us |   Advertise |   Legal Notice |   RSS |   Guardian Digital
(c)Copyright 2014 Guardian Digital, Inc. All rights reserved.