[Backports-security-announce] Security Update for nagios3

2008-12-08T17:54:08
ID DEBIAN:0EE95663F53F749E6C754C45C76D9D7F:38F0E
Type debian
Reporter Debian
Modified 2008-12-08T17:54:08

Description

Jan Wagner uploaded a new package for nagios3 which fixed the following security problem:

CVE-2008-5028, SA32610 and Debian Bug #504894

Andreas Ericsson has discovered a vulnerability in Nagios, which can be exploited by malicious people to conduct cross-site request forgery attacks.

The application allows users to perform certain actions via HTTP requests to "cmd.cgi" without performing any validity checks to verify the request. This can be exploited to execute certain Nagios commands (e.g. to disable notifications) when a logged-in administrator visits a malicious web site.

For the etch-backports distribution the problem has been fixed in version 3.0.6-1~bpo40+1.

For the lenny distribution the problem will be fixed soon in version 3.0.6-1.

For the sid distribution the problem has been fixed in version 3.0.6-1.

Upgrade instructions

If you don't use pinning (see [1]) you have to update nagios3 manually via "apt-get -t etch-backports install nagios". [1] <http://backports.org/dokuwiki/doku.php?id=instructions>

We recommend to pin the backports repository to 200 so that new versions of installed backports will be installed automatically:

Package: * Pin: release a=etch-backports Pin-Priority: 200