FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2013-7108

This CVE name corresponds to:

Entered	Topic
2014-01-14	nagios -- denial of service vulnerability

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2013-7108 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2013-7108
Phase	Assigned(20131215)

Description

Multiple off-by-one errors in Nagios Core 3.5.1, 4.0.2, and earlier, and Icinga before 1.8.5, 1.9 before 1.9.4, and 1.10 before 1.10.2 allow remote authenticated users to obtain sensitive information from process memory or cause a denial of service (crash) via a long string in the last key value in the variable list to the process_cgivars function in (1) avail.c, (2) cmd.c, (3) config.c, (4) extinfo.c, (5) histogram.c, (6) notifications.c, (7) outages.c, (8) status.c, (9) statusmap.c, (10) summary.c, and (11) trends.c in cgi/, which triggers a heap-based buffer over-read.

References

Source	Reference
MLIST	[oss-security] 20131224 Re: CVE request: denial of service in Nagios (process_cgivars())
CONFIRM	http://sourceforge.net/p/nagios/nagioscore/ci/d97e03f32741a7d851826b03ed73ff4c9612a866/
CONFIRM	https://dev.icinga.org/issues/5251
CONFIRM	https://www.icinga.org/2013/12/17/icinga-security-releases-1-10-2-1-9-4-1-8-5/
MANDRIVA	MDVSA-2014:004
SUSE	openSUSE-SU-2014:0016
SUSE	openSUSE-SU-2014:0039
SUSE	openSUSE-SU-2014:0069
SUSE	openSUSE-SU-2014:0097
SECUNIA	55976
SECUNIA	56316