===================================================================== CERT-Renater Note d'Information No. 2008/VULN607 _____________________________________________________________________ DATE : 22/12/2008 HARDWARE PLATFORM(S) : / OPERATING SYSTEM(S) : Systems running nagios. ====================================================================== https://lists.ubuntu.com/archives/ubuntu-security-announce/2008-December/000813.html https://lists.ubuntu.com/archives/ubuntu-security-announce/2008-December/000814.html ______________________________________________________________________ =========================================================== Ubuntu Security Notice USN-698-1 December 22, 2008 nagios vulnerability CVE-2008-5027 =========================================================== A security issue affects the following Ubuntu releases: Ubuntu 6.06 LTS This advisory also applies to the corresponding versions of Kubuntu, Edubuntu, and Xubuntu. The problem can be corrected by upgrading your system to the following package versions: Ubuntu 6.06 LTS: nagios-common 2:1.3-cvs.20050402-8ubuntu8 After a standard system upgrade you need to restart Nagios to effect the necessary changes. Details follow: It was discovered that Nagios did not properly parse commands submitted using the web interface. An authenticated user could use a custom form or a browser addon to bypass security restrictions and submit unauthorized commands. Updated packages for Ubuntu 6.06 LTS: Source archives: http://security.ubuntu.com/ubuntu/pool/main/n/nagios/nagios_1.3-cvs.20050402-8ubuntu8.diff.gz Size/MD5: 70914 96d8036bdb33aadd3141715039c91b24 http://security.ubuntu.com/ubuntu/pool/main/n/nagios/nagios_1.3-cvs.20050402-8ubuntu8.dsc Size/MD5: 959 0393336015bf452f5dfeb74d75245311 http://security.ubuntu.com/ubuntu/pool/main/n/nagios/nagios_1.3-cvs.20050402.orig.tar.gz Size/MD5: 1621251 0f92b7b8e705411b7881d3650cbb5d56 Architecture independent packages: http://security.ubuntu.com/ubuntu/pool/main/n/nagios/nagios-common_1.3-cvs.20050402-8ubuntu8_all.deb Size/MD5: 1218132 d18e298ee16f4c6c6b7c5969c46044e6 amd64 architecture (Athlon64, Opteron, EM64T Xeon): http://security.ubuntu.com/ubuntu/pool/main/n/nagios/nagios-mysql_1.3-cvs.20050402-8ubuntu8_amd64.deb Size/MD5: 1030206 085483fdefd0d7bc43e55dbc5be2bcd6 http://security.ubuntu.com/ubuntu/pool/main/n/nagios/nagios-pgsql_1.3-cvs.20050402-8ubuntu8_amd64.deb Size/MD5: 1041656 09fc7bb2ff11062603680d09e290909b http://security.ubuntu.com/ubuntu/pool/main/n/nagios/nagios-text_1.3-cvs.20050402-8ubuntu8_amd64.deb Size/MD5: 1025618 61619d13effd9a4970486abf5933c756 i386 architecture (x86 compatible Intel/AMD): http://security.ubuntu.com/ubuntu/pool/main/n/nagios/nagios-mysql_1.3-cvs.20050402-8ubuntu8_i386.deb Size/MD5: 877846 544afaebec24e7e94d2ce1da3a89346c http://security.ubuntu.com/ubuntu/pool/main/n/nagios/nagios-pgsql_1.3-cvs.20050402-8ubuntu8_i386.deb Size/MD5: 886544 411d3ca5a204aa41a4a42ef6e5f56453 http://security.ubuntu.com/ubuntu/pool/main/n/nagios/nagios-text_1.3-cvs.20050402-8ubuntu8_i386.deb Size/MD5: 872936 aa31f6d1fb8a081a206eae3d6bfb3dd6 powerpc architecture (Apple Macintosh G3/G4/G5): http://security.ubuntu.com/ubuntu/pool/main/n/nagios/nagios-mysql_1.3-cvs.20050402-8ubuntu8_powerpc.deb Size/MD5: 1015630 540a27062c7f8612b7f460b2bcfd93b9 http://security.ubuntu.com/ubuntu/pool/main/n/nagios/nagios-pgsql_1.3-cvs.20050402-8ubuntu8_powerpc.deb Size/MD5: 1024374 47e0480006df0b20a83f67b56da7a9f8 http://security.ubuntu.com/ubuntu/pool/main/n/nagios/nagios-text_1.3-cvs.20050402-8ubuntu8_powerpc.deb Size/MD5: 993324 03a67a7675075050a672a4c515e8e0c3 sparc architecture (Sun SPARC/UltraSPARC): http://security.ubuntu.com/ubuntu/pool/main/n/nagios/nagios-mysql_1.3-cvs.20050402-8ubuntu8_sparc.deb Size/MD5: 918810 7340348f043dd884c88bd016ee30e41d http://security.ubuntu.com/ubuntu/pool/main/n/nagios/nagios-pgsql_1.3-cvs.20050402-8ubuntu8_sparc.deb Size/MD5: 926172 e9ccf388b828a17e868807aa39cb5b51 http://security.ubuntu.com/ubuntu/pool/main/n/nagios/nagios-text_1.3-cvs.20050402-8ubuntu8_sparc.deb Size/MD5: 917374 c88dec0d93f590f8a93ebbc701696f68 ________________________________________________________________________ =========================================================== Ubuntu Security Notice USN-698-2 December 22, 2008 nagios3 vulnerabilities CVE-2008-5027, CVE-2008-5028 =========================================================== A security issue affects the following Ubuntu releases: Ubuntu 8.10 This advisory also applies to the corresponding versions of Kubuntu, Edubuntu, and Xubuntu. The problem can be corrected by upgrading your system to the following package versions: Ubuntu 8.10: nagios3 3.0.2-1ubuntu1.1 After a standard system upgrade you need to restart Nagios to effect the necessary changes. Details follow: It was discovered that Nagios was vulnerable to a Cross-site request forgery (CSRF) vulnerability. If an authenticated nagios user were tricked into clicking a link on a specially crafted web page, an attacker could trigger commands to be processed by Nagios and execute arbitrary programs. This update alters Nagios behaviour by disabling submission of CMD_CHANGE commands. (CVE-2008-5028) It was discovered that Nagios did not properly parse commands submitted using the web interface. An authenticated user could use a custom form or a browser addon to bypass security restrictions and submit unauthorized commands. (CVE-2008-5027) Updated packages for Ubuntu 8.10: Source archives: http://security.ubuntu.com/ubuntu/pool/main/n/nagios3/nagios3_3.0.2-1ubuntu1.1.diff.gz Size/MD5: 38086 84020bf2660e52ef176a2274971e4c1b http://security.ubuntu.com/ubuntu/pool/main/n/nagios3/nagios3_3.0.2-1ubuntu1.1.dsc Size/MD5: 1644 868828fdabd748689e35083aa052a483 http://security.ubuntu.com/ubuntu/pool/main/n/nagios3/nagios3_3.0.2.orig.tar.gz Size/MD5: 2759331 008d71aac08660bc007f7130ea82ab80 Architecture independent packages: http://security.ubuntu.com/ubuntu/pool/main/n/nagios3/nagios3-common_3.0.2-1ubuntu1.1_all.deb Size/MD5: 72216 1cccb3e8640dbd2612caf7841ae1756b http://security.ubuntu.com/ubuntu/pool/main/n/nagios3/nagios3-doc_3.0.2-1ubuntu1.1_all.deb Size/MD5: 2063224 9769666c13c1d886228f66ff40dc729a amd64 architecture (Athlon64, Opteron, EM64T Xeon): http://security.ubuntu.com/ubuntu/pool/main/n/nagios3/nagios3-dbg_3.0.2-1ubuntu1.1_amd64.deb Size/MD5: 2660164 381e889f994b102f6e65acc67f032f7a http://security.ubuntu.com/ubuntu/pool/main/n/nagios3/nagios3_3.0.2-1ubuntu1.1_amd64.deb Size/MD5: 1538712 8ce98eee89e13bc544180c73c9d24ba0 i386 architecture (x86 compatible Intel/AMD): http://security.ubuntu.com/ubuntu/pool/main/n/nagios3/nagios3-dbg_3.0.2-1ubuntu1.1_i386.deb Size/MD5: 2429130 87889b6dc28b86c4aae3d0acdd9950e9 http://security.ubuntu.com/ubuntu/pool/main/n/nagios3/nagios3_3.0.2-1ubuntu1.1_i386.deb Size/MD5: 1387398 ec353697aced7539893ef9409d850120 lpia architecture (Low Power Intel Architecture): http://ports.ubuntu.com/pool/main/n/nagios3/nagios3-dbg_3.0.2-1ubuntu1.1_lpia.deb Size/MD5: 2479724 433504296b1650a7d393ab28d9b264b7 http://ports.ubuntu.com/pool/main/n/nagios3/nagios3_3.0.2-1ubuntu1.1_lpia.deb Size/MD5: 1376480 be232a1c16b5daff63b586f2cd66b9eb powerpc architecture (Apple Macintosh G3/G4/G5): http://ports.ubuntu.com/pool/main/n/nagios3/nagios3-dbg_3.0.2-1ubuntu1.1_powerpc.deb Size/MD5: 2630802 167b533ea10d8962df5bc5904133c067 http://ports.ubuntu.com/pool/main/n/nagios3/nagios3_3.0.2-1ubuntu1.1_powerpc.deb Size/MD5: 1525154 0679044c20e6a53c9311f2670834035b sparc architecture (Sun SPARC/UltraSPARC): http://ports.ubuntu.com/pool/main/n/nagios3/nagios3-dbg_3.0.2-1ubuntu1.1_sparc.deb Size/MD5: 2327204 f40329c8a8216799a365d185bcc2a646 http://ports.ubuntu.com/pool/main/n/nagios3/nagios3_3.0.2-1ubuntu1.1_sparc.deb Size/MD5: 1379752 04408878bff9de5f485c7da2c6ffde4d ====================================================================== ========================================================= Les serveurs de référence du CERT-Renater http://www.urec.fr/securite http://www.cru.fr/securite http://www.renater.fr ========================================================= + CERT-RENATER | tel : 01-53-94-20-44 + + 151 bd de l'Hopital | fax : 01-53-94-20-41 + + 75013 Paris | email: certsvp@renater.fr + =========================================================