Security Bulletin: Vulnerabilities in nagios affect PowerKVM

Summary

PowerKVM is affected by numerous vulnerabilities in nagios. These vulnerabilities are now fixed.

Vulnerability Details

CVEID: CVE-2014-5008**
DESCRIPTION:** Snoopy could allow a remote attacker to execute arbitrary commands on the system, caused by an incomplete fix related to the use of escapeshellcmd where escapeshellarg was required. An attacker could exploit this vulnerability to execute arbitrary commands on the system.
CVSS Base Score: 7.5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/116470 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P)

CVEID: CVE-2014-1878**
DESCRIPTION:** Icinga is vulnerable to a stack-based buffer overflow, caused by improper bounds checking by the cmd_submitf() function. By sending an overly long string argument, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash.
CVSS Base Score: 7.5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/91206 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P)

CVEID: CVE-2014-5009**
DESCRIPTION:** Snoopy could allow a remote attacker to execute arbitrary commands on the system, caused by an incomplete fix related to the exec() function. An attacker could exploit this vulnerability to execute arbitrary commands on the system.
CVSS Base Score: 6.8
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/94738 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:P/A:P)

CVEID: CVE-2008-4796**
DESCRIPTION:** Snoopy could allow a remote attacker to execute arbitrary commands on the system, caused by improper validation of user-supplied input by the Snoopy.class.php script. An attacker could exploit this vulnerability using a specially-crafted request to execute arbitrary commands with privileges of the application.
CVSS Base Score: 7.5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/46068 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P)

CVEID: CVE-2008-7313**
DESCRIPTION:** Snoopy could allow a remote attacker to execute arbitrary commands on the system, caused by an incomplete fix related to the _httpsrequest() function. An attacker could exploit this vulnerability to execute arbitrary commands on the system.
CVSS Base Score: 6.8
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/94737 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:P/A:P)

CVEID: CVE-2013-4214**
DESCRIPTION:** Nagios could allow a local attacker to launch a symlink attack. The html/rss-newsfeed.php script creates temporary files insecurely. A local attacker could exploit this vulnerability by creating a symbolic link from a temporary file to various files on the system, which could allow the attacker to overwrite arbitrary files on the system with elevated privileges.
CVSS Base Score: 3.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/86320 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:L/AC:M/Au:N/C:N/I:P/A:P)

CVEID: CVE-2013-7108**
DESCRIPTION:** Icinga is vulnerable to an off-by-one buffer overflow, caused by improper validation of user supplied input by process_cgivars() method. A remote attacker could overflow a buffer and execute arbitrary code on the system or cause the application.
CVSS Base Score: 4.9
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/89801 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:S/C:P/I:N/A:P)

CVEID: CVE-2013-7205**
DESCRIPTION:** Nagios is vulnerable to a denial of service, caused by an off-by-one error in the process_cgivars() function. By sending a specially-crafted key value, an attacker could exploit this vulnerability to trigger an out-of-bounds read error.
CVSS Base Score: 5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/89945 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P)

Affected Products and Versions

PowerKVM 2.1 and PowerKVM 3.1

Remediation/Fixes

Customers can update PowerKVM systems by using “yum update”.

Fix images are made available via Fix Central. For version 3.1, see https://ibm.biz/BdHggw_ _for 3.1.0.2 update 2 or later.

For version 2.1, see PowerKVM 2.1.1.3-65. Update 12 at https://ibm.biz/BdEnT8_ _ or later. Customers running v2.1 are, in any case, encouraged to upgrade to v3.1.

For v2.1 systems currently running fix levels of PowerKVM prior to 2.1.1, please see <http://download4.boulder.ibm.com/sar/CMA/OSA/05e4c/0/README&gt; for prerequisite fixes and instructions.

Workarounds and Mitigations

None