CVE-2018-6535

An issue was discovered in Icinga 2.x through 2.8.1. The lack of a constant-time password comparison function can disclose the password to an attacker...

CVE-2018-6533

An issue was discovered in Icinga 2.x through 2.8.1. By editing the init.conf file, Icinga 2 can be run as root. Following this the program can be used to run arbitrary code as root. This was fixed by no longer using init.conf to determine account information for any root-executed code a larger...

CVE-2018-6534

An issue was discovered in Icinga 2.x through 2.8.1. By sending specially crafted messages, an attacker can cause a NULL pointer dereference, which can cause the product to crash...

CVE-2018-6532

An issue was discovered in Icinga 2.x through 2.8.1. By sending specially crafted authenticated and unauthenticated requests, an attacker can exhaust a lot of memory on the server side, triggering the OOM killer...

CVE-2018-6535

An issue was discovered in Icinga 2.x through 2.8.1. The lack of a constant-time password comparison function can disclose the password to an attacker...

CVE-2018-6532

An issue was discovered in Icinga 2.x through 2.8.1. By sending specially crafted authenticated and unauthenticated requests, an attacker can exhaust a lot of memory on the server side, triggering the OOM killer...

CVE-2018-6534

An issue was discovered in Icinga 2.x through 2.8.1. By sending specially crafted messages, an attacker can cause a NULL pointer dereference, which can cause the product to crash...

CVE-2018-6535

An issue was discovered in Icinga 2.x through 2.8.1. The lack of a constant-time password comparison function can disclose the password to an attacker...

CVE-2018-6535: Undefined Security Weakness

An issue was discovered in Icinga 2.x through 2.8.1. The lack of a constant-time password comparison function can disclose the password to an attacker...

CVE-2018-6533: Undefined Security Weakness

An issue was discovered in Icinga 2.x through 2.8.1. By editing the init.conf file, Icinga 2 can be run as root. Following this the program can be used to run arbitrary code as root. This was fixed by no longer using init.conf to determine account information for any root-executed code a larger...

CVE-2018-6532: Uncontrolled Resource Consumption

An issue was discovered in Icinga 2.x through 2.8.1. By sending specially crafted authenticated and unauthenticated requests, an attacker can exhaust a lot of memory on the server side, triggering the OOM killer...

CVE-2018-6534: NULL Pointer Dereference

An issue was discovered in Icinga 2.x through 2.8.1. By sending specially crafted messages, an attacker can cause a NULL pointer dereference, which can cause the product to crash...

PT-2018-17616

Name of the Vulnerable Software and Affected Versions Icinga versions 2.x through 2.8.1 Description An issue allows an attacker to exhaust a lot of memory on the server side by sending specially crafted requests, triggering the OOM killer. This can be done through both authenticated and...

PT-2018-17617

Name of the Vulnerable Software and Affected Versions Icinga versions 2.x through 2.8.1 Description An issue was discovered that allows Icinga 2 to be run as root by editing the init.conf file, enabling the program to execute arbitrary code as root. This issue was resolved by changing how account...

PT-2018-17618

Name of the Vulnerable Software and Affected Versions Icinga versions 2.x through 2.8.1 Description An issue was discovered that allows an attacker to cause a NULL pointer dereference by sending specially crafted messages, potentially causing the product to crash. Recommendations For versions 2.x...

PT-2018-17619

Name of the Vulnerable Software and Affected Versions Icinga versions 2.x through 2.8.1 Description An issue in the password comparison function can disclose the password to an attacker due to the lack of a constant-time comparison, potentially allowing attackers to exploit this and gain...

Icinga elevation of privilege vulnerability (CNVD-2018-05430)

Icinga is a set of enterprise-grade open source monitoring system from the Icinga project, a product between the Nagios Community Edition and Enterprise Edition. A security vulnerability exists in Icinga versions 2.x through 2.8.1. A local attacker can exploit the vulnerability to terminate...

CVE-2018-6536

An issue was discovered in Icinga 2.x through 2.8.1. The daemon creates an icinga2.pid file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for icinga2.pid modification before a root script...

CVE-2018-6536

An issue was discovered in Icinga 2.x through 2.8.1. The daemon creates an icinga2.pid file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for icinga2.pid modification before a root script...

DEBIAN-CVE-2018-6536

An issue was discovered in Icinga 2.x through 2.8.1. The daemon creates an icinga2.pid file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for icinga2.pid modification before a root script...