6.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
0.027 Low
EPSS
Percentile
89.4%
Jan Wagner uploaded a new package for nagios3 which fixed the following
security problem:
CVE-2008-5028, SA32610 and Debian Bug #504894
Andreas Ericsson has discovered a vulnerability in Nagios, which can be
exploited by malicious people to conduct cross-site request forgery attacks.
The application allows users to perform certain actions via HTTP requests to
"cmd.cgi" without performing any validity checks to verify the request. This
can be exploited to execute certain Nagios commands (e.g. to disable
notifications) when a logged-in administrator visits a malicious web site.
For the etch-backports distribution the problem has been fixed in
version 3.0.6-1~bpo40+1.
For the lenny distribution the problem will be fixed soon in
version 3.0.6-1.
For the sid distribution the problem has been fixed in
version 3.0.6-1.
If you don't use pinning (see [1]) you have to update nagios3
manually via "apt-get -t etch-backports install nagios".
[1] <http://backports.org/dokuwiki/doku.php?id=instructions>
We recommend to pin the backports repository to 200 so that new versions
of installed backports will be installed automatically:
Package: *
Pin: release a=etch-backports
Pin-Priority: 200
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
Debian | 5 | all | nagios3 | < 3.0.6-1 | nagios3_3.0.6-1_all.deb |