FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2013-7205

This CVE name corresponds to:

Entered	Topic
2014-01-14	nagios -- denial of service vulnerability

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2013-7205 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2013-7205
Phase	Assigned(20131223)

Description

Off-by-one error in the process_cgivars function in contrib/daemonchk.c in Nagios Core 3.5.1, 4.0.2, and earlier allows remote authenticated users to obtain sensitive information from process memory or cause a denial of service (crash) via a long string in the last key value in the variable list, which triggers a heap-based buffer over-read.

References

Source	Reference
MLIST	[oss-security] 20131224 Re: CVE request: denial of service in Nagios (process_cgivars())
CONFIRM	http://sourceforge.net/p/nagios/nagioscore/ci/d97e03f32741a7d851826b03ed73ff4c9612a866/
MANDRIVA	MDVSA-2014:004
SECUNIA	55976