Nagios Web Interface Privilege Escalation Vulnerability

Bugtraq ID:	32156
Class:	Unknown
CVE:	CVE-2008-5027
Remote:	Yes
Local:	No
Published:	Nov 06 2008 12:00AM
Updated:	Apr 13 2015 09:49PM
Credit:	This issue was disclosed by the vendor.
Vulnerable:	Ubuntu Ubuntu Linux 8.10 sparc Ubuntu Ubuntu Linux 8.10 powerpc Ubuntu Ubuntu Linux 8.10 lpia Ubuntu Ubuntu Linux 8.10 i386 Ubuntu Ubuntu Linux 8.10 amd64 Ubuntu Ubuntu Linux 8.04 LTS sparc Ubuntu Ubuntu Linux 8.04 LTS powerpc Ubuntu Ubuntu Linux 8.04 LTS lpia Ubuntu Ubuntu Linux 8.04 LTS i386 Ubuntu Ubuntu Linux 8.04 LTS amd64 Ubuntu Ubuntu Linux 6.06 LTS sparc Ubuntu Ubuntu Linux 6.06 LTS powerpc Ubuntu Ubuntu Linux 6.06 LTS i386 Ubuntu Ubuntu Linux 6.06 LTS amd64 Nagios Nagios 3.0.4 HP Insight Control for Linux (ICE-LX) 2.10 Gentoo Linux
Not Vulnerable:	Nagios Nagios 3.0.5

Nagios Web Interface Privilege Escalation Vulnerability

Nagios is prone to an unspecified privilege-escalation scripting vulnerability.

An attacker with low-level privileges may exploit this issue to bypass authorization and cause arbitrary commands to run within the context of the Nagios server. This may aid in further attacks.

Few technical details are available at this time; we will update this BID as more information emerges.

The issue affects versions prior to Nagios 3.0.5.

Nagios Web Interface Privilege Escalation Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Nagios Web Interface Privilege Escalation Vulnerability

Solution:
The vendor has released updates. Please see the references for details.


Ubuntu Ubuntu Linux 8.10 lpia

• Ubuntu nagios3-common_3.0.2-1ubuntu1.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/nagios3/nagios3-common_3 .0.2-1ubuntu1.1_all.deb


• Ubuntu nagios3-dbg_3.0.2-1ubuntu1.1_lpia.deb
  http://ports.ubuntu.com/pool/main/n/nagios3/nagios3-dbg_3.0.2-1ubuntu1 .1_lpia.deb


• Ubuntu nagios3-doc_3.0.2-1ubuntu1.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/nagios3/nagios3-doc_3.0. 2-1ubuntu1.1_all.deb


• Ubuntu nagios3_3.0.2-1ubuntu1.1_lpia.deb
  http://ports.ubuntu.com/pool/main/n/nagios3/nagios3_3.0.2-1ubuntu1.1_l pia.deb

Ubuntu Ubuntu Linux 6.06 LTS amd64

• Ubuntu nagios-common_1.3-cvs.20050402-8ubuntu8_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/nagios/nagios-common_1.3 -cvs.20050402-8ubuntu8_all.deb


• Ubuntu nagios-mysql_1.3-cvs.20050402-8ubuntu8_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/nagios/nagios-mysql_1.3- cvs.20050402-8ubuntu8_amd64.deb


• Ubuntu nagios-pgsql_1.3-cvs.20050402-8ubuntu8_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/nagios/nagios-pgsql_1.3- cvs.20050402-8ubuntu8_amd64.deb


• Ubuntu nagios-text_1.3-cvs.20050402-8ubuntu8_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/nagios/nagios-text_1.3-c vs.20050402-8ubuntu8_amd64.deb

Ubuntu Ubuntu Linux 8.10 sparc

• Ubuntu nagios3-common_3.0.2-1ubuntu1.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/nagios3/nagios3-common_3 .0.2-1ubuntu1.1_all.deb


• Ubuntu nagios3-dbg_3.0.2-1ubuntu1.1_sparc.deb
  http://ports.ubuntu.com/pool/main/n/nagios3/nagios3-dbg_3.0.2-1ubuntu1 .1_sparc.deb


• Ubuntu nagios3-doc_3.0.2-1ubuntu1.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/nagios3/nagios3-doc_3.0. 2-1ubuntu1.1_all.deb


• Ubuntu nagios3_3.0.2-1ubuntu1.1_sparc.deb
  http://ports.ubuntu.com/pool/main/n/nagios3/nagios3_3.0.2-1ubuntu1.1_s parc.deb

Ubuntu Ubuntu Linux 8.04 LTS powerpc

• Ubuntu nagios2-common_2.11-1ubuntu1.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/n/nagios2/nagios2-comm on_2.11-1ubuntu1.4_all.deb


• Ubuntu nagios2-dbg_2.11-1ubuntu1.4_powerpc.deb
  http://ports.ubuntu.com/pool/universe/n/nagios2/nagios2-dbg_2.11-1ubun tu1.4_powerpc.deb


• Ubuntu nagios2-doc_2.11-1ubuntu1.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/n/nagios2/nagios2-doc_ 2.11-1ubuntu1.4_all.deb


• Ubuntu nagios2_2.11-1ubuntu1.4_powerpc.deb
  http://ports.ubuntu.com/pool/universe/n/nagios2/nagios2_2.11-1ubuntu1. 4_powerpc.deb

Ubuntu Ubuntu Linux 8.10 powerpc

• Ubuntu nagios3-common_3.0.2-1ubuntu1.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/nagios3/nagios3-common_3 .0.2-1ubuntu1.1_all.deb


• Ubuntu nagios3-dbg_3.0.2-1ubuntu1.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/n/nagios3/nagios3-dbg_3.0.2-1ubuntu1 .1_powerpc.deb


• Ubuntu nagios3-doc_3.0.2-1ubuntu1.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/nagios3/nagios3-doc_3.0. 2-1ubuntu1.1_all.deb


• Ubuntu nagios3_3.0.2-1ubuntu1.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/n/nagios3/nagios3_3.0.2-1ubuntu1.1_p owerpc.deb

Ubuntu Ubuntu Linux 8.10 i386

• Ubuntu nagios3-common_3.0.2-1ubuntu1.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/nagios3/nagios3-common_3 .0.2-1ubuntu1.1_all.deb


• Ubuntu nagios3-dbg_3.0.2-1ubuntu1.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/nagios3/nagios3-dbg_3.0. 2-1ubuntu1.1_i386.deb


• Ubuntu nagios3-doc_3.0.2-1ubuntu1.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/nagios3/nagios3-doc_3.0. 2-1ubuntu1.1_all.deb


• Ubuntu nagios3_3.0.2-1ubuntu1.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/nagios3/nagios3_3.0.2-1u buntu1.1_i386.deb

Ubuntu Ubuntu Linux 8.04 LTS sparc

• Ubuntu nagios2-common_2.11-1ubuntu1.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/n/nagios2/nagios2-comm on_2.11-1ubuntu1.4_all.deb


• Ubuntu nagios2-dbg_2.11-1ubuntu1.4_sparc.deb
  http://ports.ubuntu.com/pool/universe/n/nagios2/nagios2-dbg_2.11-1ubun tu1.4_sparc.deb


• Ubuntu nagios2-doc_2.11-1ubuntu1.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/n/nagios2/nagios2-doc_ 2.11-1ubuntu1.4_all.deb


• Ubuntu nagios2_2.11-1ubuntu1.4_sparc.deb
  http://ports.ubuntu.com/pool/universe/n/nagios2/nagios2_2.11-1ubuntu1. 4_sparc.deb

Ubuntu Ubuntu Linux 6.06 LTS sparc

• Ubuntu nagios-common_1.3-cvs.20050402-8ubuntu8_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/nagios/nagios-common_1.3 -cvs.20050402-8ubuntu8_all.deb


• Ubuntu nagios-mysql_1.3-cvs.20050402-8ubuntu8_sparc.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/nagios/nagios-mysql_1.3- cvs.20050402-8ubuntu8_sparc.deb


• Ubuntu nagios-pgsql_1.3-cvs.20050402-8ubuntu8_sparc.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/nagios/nagios-pgsql_1.3- cvs.20050402-8ubuntu8_sparc.deb


• Ubuntu nagios-text_1.3-cvs.20050402-8ubuntu8_sparc.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/nagios/nagios-text_1.3-c vs.20050402-8ubuntu8_sparc.deb

Ubuntu Ubuntu Linux 8.04 LTS i386

• Ubuntu nagios2-common_2.11-1ubuntu1.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/n/nagios2/nagios2-comm on_2.11-1ubuntu1.4_all.deb


• Ubuntu nagios2-dbg_2.11-1ubuntu1.4_i386.deb
  http://security.ubuntu.com/ubuntu/pool/universe/n/nagios2/nagios2-dbg_ 2.11-1ubuntu1.4_i386.deb


• Ubuntu nagios2-doc_2.11-1ubuntu1.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/n/nagios2/nagios2-doc_ 2.11-1ubuntu1.4_all.deb


• Ubuntu nagios2_2.11-1ubuntu1.4_i386.deb
  http://security.ubuntu.com/ubuntu/pool/universe/n/nagios2/nagios2_2.11 -1ubuntu1.4_i386.deb

Ubuntu Ubuntu Linux 8.04 LTS amd64

• Ubuntu nagios2-common_2.11-1ubuntu1.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/n/nagios2/nagios2-comm on_2.11-1ubuntu1.4_all.deb


• Ubuntu nagios2-dbg_2.11-1ubuntu1.4_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/universe/n/nagios2/nagios2-dbg_ 2.11-1ubuntu1.4_amd64.deb


• Ubuntu nagios2-doc_2.11-1ubuntu1.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/n/nagios2/nagios2-doc_ 2.11-1ubuntu1.4_all.deb


• Ubuntu nagios2_2.11-1ubuntu1.4_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/universe/n/nagios2/nagios2_2.11 -1ubuntu1.4_amd64.deb

Ubuntu Ubuntu Linux 6.06 LTS powerpc

• Ubuntu nagios-common_1.3-cvs.20050402-8ubuntu8_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/nagios/nagios-common_1.3 -cvs.20050402-8ubuntu8_all.deb


• Ubuntu nagios-mysql_1.3-cvs.20050402-8ubuntu8_powerpc.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/nagios/nagios-mysql_1.3- cvs.20050402-8ubuntu8_powerpc.deb


• Ubuntu nagios-pgsql_1.3-cvs.20050402-8ubuntu8_powerpc.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/nagios/nagios-pgsql_1.3- cvs.20050402-8ubuntu8_powerpc.deb


• Ubuntu nagios-text_1.3-cvs.20050402-8ubuntu8_powerpc.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/nagios/nagios-text_1.3-c vs.20050402-8ubuntu8_powerpc.deb

Ubuntu Ubuntu Linux 8.10 amd64

• Ubuntu nagios3-common_3.0.2-1ubuntu1.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/nagios3/nagios3-common_3 .0.2-1ubuntu1.1_all.deb


• Ubuntu nagios3-dbg_3.0.2-1ubuntu1.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/nagios3/nagios3-dbg_3.0. 2-1ubuntu1.1_amd64.deb


• Ubuntu nagios3-doc_3.0.2-1ubuntu1.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/nagios3/nagios3-doc_3.0. 2-1ubuntu1.1_all.deb


• Ubuntu nagios3_3.0.2-1ubuntu1.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/nagios3/nagios3_3.0.2-1u buntu1.1_amd64.deb

Ubuntu Ubuntu Linux 8.04 LTS lpia

• Ubuntu nagios2-common_2.11-1ubuntu1.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/n/nagios2/nagios2-comm on_2.11-1ubuntu1.4_all.deb


• Ubuntu nagios2-dbg_2.11-1ubuntu1.4_lpia.deb
  http://ports.ubuntu.com/pool/universe/n/nagios2/nagios2-dbg_2.11-1ubun tu1.4_lpia.deb


• Ubuntu nagios2-doc_2.11-1ubuntu1.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/n/nagios2/nagios2-doc_ 2.11-1ubuntu1.4_all.deb


• Ubuntu nagios2_2.11-1ubuntu1.4_lpia.deb
  http://ports.ubuntu.com/pool/universe/n/nagios2/nagios2_2.11-1ubuntu1. 4_lpia.deb

Ubuntu Ubuntu Linux 6.06 LTS i386

• Ubuntu nagios-common_1.3-cvs.20050402-8ubuntu8_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/nagios/nagios-common_1.3 -cvs.20050402-8ubuntu8_all.deb


• Ubuntu nagios-mysql_1.3-cvs.20050402-8ubuntu8_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/nagios/nagios-mysql_1.3- cvs.20050402-8ubuntu8_i386.deb


• Ubuntu nagios-pgsql_1.3-cvs.20050402-8ubuntu8_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/nagios/nagios-pgsql_1.3- cvs.20050402-8ubuntu8_i386.deb


• Ubuntu nagios-text_1.3-cvs.20050402-8ubuntu8_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/nagios/nagios-text_1.3-c vs.20050402-8ubuntu8_i386.deb

HP Insight Control for Linux (ICE-LX) 2.10

• HP HP_ICE_LX_V2.10.01_patch_kit_511708_003.iso
  https://h20392.www2.hp.com/portal/swdepot/try.do?productNumber=HPICELX

Nagios Nagios 3.0.4

• Nagios nagios-3.0.5.tar.gz
  http://downloads.sourceforge.net/nagios/nagios-3.0.5.tar.gz?modtime=12 25838135&big_mirror=0

Nagios Web Interface Privilege Escalation Vulnerability

References:

• CVE request: Nagios (two issues) (Andreas Ericsson)
  
• Nagios Homepage (Nagios)
  
• [security bulletin] HPSBMA02419 SSRT090060 rev.1 - Insight Control Suite For Lin ([email protected])