7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.968 High
EPSS
Percentile
99.7%
Multiple stack-based buffer overflows in the get_history function in
history.cgi in Nagios Core before 3.4.4, and Icinga 1.6.x before 1.6.2,
1.7.x before 1.7.4, and 1.8.x before 1.8.4, might allow remote attackers to
execute arbitrary code via a long (1) host_name variable (host parameter)
or (2) svc_description variable.
Author | Note |
---|---|
mdeslaur | debian bug says nagios patch is possibly incomplete downgrading to “negligible” because of FORTIFY_SOURCE |