CVE-2008-5027

Publication date 10 November 2008

Last updated 24 July 2024

Ubuntu priority

Medium

Why this priority?

The Nagios process in (1) Nagios before 3.0.5 and (2) op5 Monitor before 4.0.1 allows remote authenticated users to bypass authorization checks, and trigger execution of arbitrary programs by this process, via an (a) custom form or a (b) browser addon.

Read the notes from the security team

Status

Package Ubuntu Release Status
nagios 8.10 intrepid Not in release
8.04 LTS hardy Not in release
7.10 gutsy Ignored end of life, was needed
6.06 LTS dapper
Fixed 2:1.3-cvs.20050402-8ubuntu8
nagios2 8.10 intrepid Not in release
8.04 LTS hardy
Fixed 2.11-1ubuntu1.4
7.10 gutsy Ignored end of life, was needed
6.06 LTS dapper Not in release
nagios3 8.10 intrepid
Fixed 3.0.2-1ubuntu1.1
8.04 LTS hardy Not in release
7.10 gutsy Not in release
6.06 LTS dapper Not in release

Notes

mdeslaur

Nagios 1.x doesn't have the CHANGE commands, so authenticated users wouldn't be able to trigger arbitrary programs. They could bypass authorization checks by submitting commands with linefeeds though. Also see CVE-2008-6373

References

Related Ubuntu Security Notices (USN)

    • USN-698-3
    • Nagios vulnerabilities
    • 23 December 2008
    • USN-698-1
    • Nagios vulnerability
    • 22 December 2008
    • USN-698-2
    • Nagios3 vulnerabilities
    • 22 December 2008

Other references