Monit fails to properly handle negative Content-Length fields

2004-04-06T00:00:00
ID VU:623854
Type cert
Reporter CERT
Modified 2004-04-06T14:14:00

Description

Overview

Monit fails to properly handle HTTP requests containing a negative Content-Length field.

Description

Monit is a utility to monitor system processes, files, directories, devices, and remote hosts. It provides a web-based interface that can be used to access the Monit server. When processing HTTP requests, Monit fails to properly sanitize the Content-Length field. By supplying a negative value for the Content-Length field of an HTTP request, an unauthenticated, remote attacker could cause the Monit daemon to crash.


Impact

A remote, unauthenticated attacker could cause the Monit daemon to crash, resulting in a denial-of-service condition.


Solution

Upgrade

Upgrade to Monit version 4.1.1 or later.


Vendor Information

623854

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Additional information available

__ Sort by: Status Alphabetical

Expand all

Javascript is disabled. Click here to view vendors.

Tildeslash __ Affected

Updated: April 06, 2004

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

Please refer to the Monit changelog.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

CVSS Metrics

Group | Score | Vector
---|---|---
Base | |
Temporal | |
Environmental | |

References

  • <http://www.tildeslash.com/monit/>
  • <http://www.tildeslash.com/monit/changes.html>
  • <http://www.s-quadra.com/advisories/Adv-20031124.txt>
  • <http://www.securityfocus.com/bid/9098>
  • <http://forums.gentoo.org/viewtopic.php?t=155764>

Acknowledgements

This vulnerability was reported by Evgeny Legerov of S-Quadra.

This document was written by Damon Morda.

Other Information

CVE IDs: | None
---|---
Severity Metric: | 1.27
Date Public: | 2004-03-31
Date First Published: | 2004-04-06
Date Last Updated: | 2004-04-06 14:14 UTC
Document Revision: | 16