[SECURITY] [DLA 60-1] icinga security update

2014-09-2416:14:21

lists.debian.org

5.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:N/A:P

7.8 High

AI Score

Confidence

High

0.941 High

EPSS

Percentile

99.2%

JSON

Package : icinga
Version : 1.0.2-2+squeeze2
CVE ID : CVE-2013-7108 CVE-2014-1878

Two fixes for the Classic UI:

fix off-by-one memory access in process_cgivars() (CVE-2013-7108)
prevent possible buffer overflows in cmd.cgi (CVE-2014-1878)
Attachment:
signature.asc
Description: This is a digitally signed message part.

OSVersionArchitecturePackageVersionFilename
Debian7kfreebsd-amd64icinga-cgi< 1.7.1-7icinga-cgi_1.7.1-7_kfreebsd-amd64.deb
Debian7ia64icinga< 1.7.1-7icinga_1.7.1-7_ia64.deb
Debian6allicinga-common< 1.0.2-2+squeeze2icinga-common_1.0.2-2+squeeze2_all.deb
Debian7i386nagios3-cgi< 3.4.1-3+deb7u2nagios3-cgi_3.4.1-3+deb7u2_i386.deb
Debian7i386nagios3-core< 3.4.1-3+deb7u2nagios3-core_3.4.1-3+deb7u2_i386.deb
Debian7amd64nagios3-dbg< 3.4.1-3+deb7u2nagios3-dbg_3.4.1-3+deb7u2_amd64.deb
Debian7s390icinga-cgi< 1.7.1-7icinga-cgi_1.7.1-7_s390.deb
Debian6allicinga< 1.0.2-2+squeeze2icinga_1.0.2-2+squeeze2_all.deb
Debian7allnagios3-common< 3.4.1-3+deb7u2nagios3-common_3.4.1-3+deb7u2_all.deb
Debian8i386nagios3< 3.5.1.dfsg-2+deb8u1nagios3_3.5.1.dfsg-2+deb8u1_i386.deb

OS	Version	Architecture	Package	Version	Filename
Debian	7	kfreebsd-amd64	icinga-cgi	< 1.7.1-7	icinga-cgi_1.7.1-7_kfreebsd-amd64.deb
Debian	7	ia64	icinga	< 1.7.1-7	icinga_1.7.1-7_ia64.deb
Debian	6	all	icinga-common	< 1.0.2-2+squeeze2	icinga-common_1.0.2-2+squeeze2_all.deb
Debian	7	i386	nagios3-cgi	< 3.4.1-3+deb7u2	nagios3-cgi_3.4.1-3+deb7u2_i386.deb
Debian	7	i386	nagios3-core	< 3.4.1-3+deb7u2	nagios3-core_3.4.1-3+deb7u2_i386.deb
Debian	7	amd64	nagios3-dbg	< 3.4.1-3+deb7u2	nagios3-dbg_3.4.1-3+deb7u2_amd64.deb
Debian	7	s390	icinga-cgi	< 1.7.1-7	icinga-cgi_1.7.1-7_s390.deb
Debian	6	all	icinga	< 1.0.2-2+squeeze2	icinga_1.0.2-2+squeeze2_all.deb
Debian	7	all	nagios3-common	< 3.4.1-3+deb7u2	nagios3-common_3.4.1-3+deb7u2_all.deb
Debian	8	i386	nagios3	< 3.5.1.dfsg-2+deb8u1	nagios3_3.5.1.dfsg-2+deb8u1_i386.deb