Security Bulletin: Vulnerabilities in nagios affect PowerKVM

Summary PowerKVM is affected by numerous vulnerabilities in nagios. These vulnerabilities are now fixed. Vulnerability Details CVEID: CVE-2014-5008 DESCRIPTION: Snoopy could allow a remote attacker to execute arbitrary commands on the system, caused by an incomplete fix related to the use of...

Icinga 2 Detection (HTTP)

HTTP based detection of Icinga 2. Note: Providing Icinga2 API Credentials can lead to better results. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

Icinga Password Disclosure Vulnerability

Icinga is an open source computer system and network monitoring application. Icinga suffers from a password disclosure vulnerability. The vulnerability arises due to the lack of a constant time password comparison feature. An attacker can exploit this vulnerability to obtain a password...

Icinga Null Pointer Dereference Vulnerability

Icinga is an open source computer system and network monitoring application. Icinga suffers from a null pointer dereference vulnerability. An attacker could exploit this vulnerability by sending specially crafted messages to cause a denial of service...

Icinga Arbitrary Code Execution Vulnerability

Icinga is an open source computer system and network monitoring application. Icinga suffers from an arbitrary code execution vulnerability. An attacker can make Icinga 2 run with root privileges by editing the init.conf file, which can be used to execute arbitrary code with root privileges...

Icinga Memory Consumption Vulnerability

Icinga is an open source computer system and network monitoring application. Icinga suffers from a memory consumption vulnerability. An attacker can exploit this vulnerability by sending specially crafted requests that consume large amounts of server-side memory, which can trigger an OOM killer...

CVE-2018-6532

An issue was discovered in Icinga 2.x through 2.8.1. By sending specially crafted authenticated and unauthenticated requests, an attacker can exhaust a lot of memory on the server side, triggering the OOM killer...

CVE-2018-6533

An issue was discovered in Icinga 2.x through 2.8.1. By editing the init.conf file, Icinga 2 can be run as root. Following this the program can be used to run arbitrary code as root. This was fixed by no longer using init.conf to determine account information for any root-executed code a larger...

CVE-2018-6534

An issue was discovered in Icinga 2.x through 2.8.1. By sending specially crafted messages, an attacker can cause a NULL pointer dereference, which can cause the product to crash...

CVE-2018-6535

An issue was discovered in Icinga 2.x through 2.8.1. The lack of a constant-time password comparison function can disclose the password to an attacker...

Default credentials

An issue was discovered in Icinga 2.x through 2.8.1. The lack of a constant-time password comparison function can disclose the password to an attacker...

Design/Logic Flaw

An issue was discovered in Icinga 2.x through 2.8.1. By editing the init.conf file, Icinga 2 can be run as root. Following this the program can be used to run arbitrary code as root. This was fixed by no longer using init.conf to determine account information for any root-executed code a larger...

Code injection

An issue was discovered in Icinga 2.x through 2.8.1. By sending specially crafted authenticated and unauthenticated requests, an attacker can exhaust a lot of memory on the server side, triggering the OOM killer...

Null pointer dereference

An issue was discovered in Icinga 2.x through 2.8.1. By sending specially crafted messages, an attacker can cause a NULL pointer dereference, which can cause the product to crash...

CVE-2018-6532

An issue was discovered in Icinga 2.x through 2.8.1. By sending specially crafted authenticated and unauthenticated requests, an attacker can exhaust a lot of memory on the server side, triggering the OOM killer...

CVE-2018-6533

An issue was discovered in Icinga 2.x through 2.8.1. By editing the init.conf file, Icinga 2 can be run as root. Following this the program can be used to run arbitrary code as root. This was fixed by no longer using init.conf to determine account information for any root-executed code a larger...

CVE-2018-6535

An issue was discovered in Icinga 2.x through 2.8.1. The lack of a constant-time password comparison function can disclose the password to an attacker...

CVE-2018-6534

An issue was discovered in Icinga 2.x through 2.8.1. By sending specially crafted messages, an attacker can cause a NULL pointer dereference, which can cause the product to crash...

UBUNTU-CVE-2018-6534

An issue was discovered in Icinga 2.x through 2.8.1. By sending specially crafted messages, an attacker can cause a NULL pointer dereference, which can cause the product to crash...

UBUNTU-CVE-2018-6535

An issue was discovered in Icinga 2.x through 2.8.1. The lack of a constant-time password comparison function can disclose the password to an attacker...