Nagios 'statuswml.cgi' Remote Arbitrary Shell Command Injection Vulnerability

Bugtraq ID:	35464
Class:	Input Validation Error
CVE:	CVE-2009-2288
Remote:	Yes
Local:	No
Published:	Jun 22 2009 12:00AM
Updated:	Apr 13 2015 08:43PM
Credit:	Paul
Vulnerable:	Ubuntu Ubuntu Linux 9.04 sparc Ubuntu Ubuntu Linux 9.04 powerpc Ubuntu Ubuntu Linux 9.04 lpia Ubuntu Ubuntu Linux 9.04 i386 Ubuntu Ubuntu Linux 9.04 amd64 Ubuntu Ubuntu Linux 8.10 sparc Ubuntu Ubuntu Linux 8.10 powerpc Ubuntu Ubuntu Linux 8.10 lpia Ubuntu Ubuntu Linux 8.10 i386 Ubuntu Ubuntu Linux 8.10 amd64 Ubuntu Ubuntu Linux 8.04 LTS sparc Ubuntu Ubuntu Linux 8.04 LTS powerpc Ubuntu Ubuntu Linux 8.04 LTS lpia Ubuntu Ubuntu Linux 8.04 LTS i386 Ubuntu Ubuntu Linux 8.04 LTS amd64 SuSE SUSE Linux Enterprise 11 SuSE SUSE Linux Enterprise 10 SuSE openSUSE 10.3 S.u.S.E. openSUSE 11.1 S.u.S.E. openSUSE 11.0 RedHat HPC Solution EL5 5 Nagios Nagios 3.0.6 Nagios Nagios 3.0.5 Nagios Nagios 3.0.4 Nagios Nagios 2.9 Nagios Nagios 2.8 Nagios Nagios 2.7 Nagios Nagios 2.12 Nagios Nagios 2.11 Nagios Nagios 2.10 MandrakeSoft Enterprise Server 5 x86_64 MandrakeSoft Enterprise Server 5 MandrakeSoft Corporate Server 4.0 x86_64 MandrakeSoft Corporate Server 4.0 HP Insight Control for Linux (ICE-LX) 2.10 HP Insight Control 6.0 Gentoo Linux Debian Linux 5.0 sparc Debian Linux 5.0 s/390 Debian Linux 5.0 powerpc Debian Linux 5.0 mipsel Debian Linux 5.0 mips Debian Linux 5.0 m68k Debian Linux 5.0 ia-64 Debian Linux 5.0 ia-32 Debian Linux 5.0 hppa Debian Linux 5.0 armel Debian Linux 5.0 arm Debian Linux 5.0 amd64 Debian Linux 5.0 alpha Debian Linux 5.0
Not Vulnerable:	Nagios Nagios 3.1.1

Nagios 'statuswml.cgi' Remote Arbitrary Shell Command Injection Vulnerability

Nagios is prone to a remote command-injection vulnerability because it fails to adequately sanitize user-supplied input data.

Remote attackers can exploit this issue to execute arbitrary shell commands with the privileges of the user running the application.

NOTE: For an exploit to succeed, access to the WAP interface's ping feature must be allowed.

Versions prior to Nagios 3.1.1 are vulnerable.

Nagios 'statuswml.cgi' Remote Arbitrary Shell Command Injection Vulnerability

An attacker can exploit the issue via a browser.

The following example URI is available:

https://www.example.com/nagios/cgi-bin/statuswml.cgi?ping=173.45.235.65%3Becho+%24PATH

The following commercial exploit is available for Immunity CANVAS:

https://www.immunityinc.com/downloads/immpartners/nagios_ping.tar.gz

Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.

Nagios 'statuswml.cgi' Remote Arbitrary Shell Command Injection Vulnerability

Solution:
Updates are available. Please see the references for details.


Debian Linux 5.0 ia-64

• Debian nagios3-common_3.0.6-4~lenny2_all.deb
  http://security.debian.org/pool/updates/main/n/nagios3/nagios3-common_ 3.0.6-4~lenny2_all.deb


• Debian nagios3-dbg_3.0.6-4~lenny2_ia64.deb
  http://security.debian.org/pool/updates/main/n/nagios3/nagios3-dbg_3.0 .6-4~lenny2_ia64.deb


• Debian nagios3-doc_3.0.6-4~lenny2_all.deb
  http://security.debian.org/pool/updates/main/n/nagios3/nagios3-doc_3.0 .6-4~lenny2_all.deb


• Debian nagios3_3.0.6-4~lenny2_ia64.deb
  http://security.debian.org/pool/updates/main/n/nagios3/nagios3_3.0.6-4 ~lenny2_ia64.deb

Ubuntu Ubuntu Linux 8.04 LTS powerpc

• Ubuntu nagios2-common_2.11-1ubuntu1.5_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/n/nagios2/nagios2-comm on_2.11-1ubuntu1.5_all.deb


• Ubuntu nagios2-dbg_2.11-1ubuntu1.5_powerpc.deb
  http://ports.ubuntu.com/pool/universe/n/nagios2/nagios2-dbg_2.11-1ubun tu1.5_powerpc.deb


• Ubuntu nagios2-doc_2.11-1ubuntu1.5_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/n/nagios2/nagios2-doc_ 2.11-1ubuntu1.5_all.deb


• Ubuntu nagios2_2.11-1ubuntu1.5_powerpc.deb
  http://ports.ubuntu.com/pool/universe/n/nagios2/nagios2_2.11-1ubuntu1. 5_powerpc.deb

Ubuntu Ubuntu Linux 8.10 powerpc

• Ubuntu nagios3-common_3.0.2-1ubuntu1.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/nagios3/nagios3-common_3 .0.2-1ubuntu1.2_all.deb


• Ubuntu nagios3-dbg_3.0.2-1ubuntu1.2_powerpc.deb
  http://ports.ubuntu.com/pool/main/n/nagios3/nagios3-dbg_3.0.2-1ubuntu1 .2_powerpc.deb


• Ubuntu nagios3-doc_3.0.2-1ubuntu1.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/nagios3/nagios3-doc_3.0. 2-1ubuntu1.2_all.deb


• Ubuntu nagios3_3.0.2-1ubuntu1.2_powerpc.deb
  http://ports.ubuntu.com/pool/main/n/nagios3/nagios3_3.0.2-1ubuntu1.2_p owerpc.deb

Ubuntu Ubuntu Linux 8.04 LTS sparc

• Ubuntu nagios2-common_2.11-1ubuntu1.5_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/n/nagios2/nagios2-comm on_2.11-1ubuntu1.5_all.deb


• Ubuntu nagios2-dbg_2.11-1ubuntu1.5_sparc.deb
  http://ports.ubuntu.com/pool/universe/n/nagios2/nagios2-dbg_2.11-1ubun tu1.5_sparc.deb


• Ubuntu nagios2-doc_2.11-1ubuntu1.5_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/n/nagios2/nagios2-doc_ 2.11-1ubuntu1.5_all.deb


• Ubuntu nagios2_2.11-1ubuntu1.5_sparc.deb
  http://ports.ubuntu.com/pool/universe/n/nagios2/nagios2_2.11-1ubuntu1. 5_sparc.deb

Ubuntu Ubuntu Linux 8.10 i386

• Ubuntu nagios3-common_3.0.2-1ubuntu1.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/nagios3/nagios3-common_3 .0.2-1ubuntu1.2_all.deb


• Ubuntu nagios3-dbg_3.0.2-1ubuntu1.2_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/nagios3/nagios3-dbg_3.0. 2-1ubuntu1.2_i386.deb


• Ubuntu nagios3-doc_3.0.2-1ubuntu1.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/nagios3/nagios3-doc_3.0. 2-1ubuntu1.2_all.deb


• Ubuntu nagios3_3.0.2-1ubuntu1.2_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/nagios3/nagios3_3.0.2-1u buntu1.2_i386.deb

MandrakeSoft Enterprise Server 5 x86_64

• Mandriva nagios-3.1.2-0.2mdvmes5.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva nagios-devel-3.1.2-0.2mdvmes5.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva nagios-theme-default-3.1.2-0.2mdvmes5.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva nagios-www-3.1.2-0.2mdvmes5.x86_64.rpm
  http://www.mandriva.com/en/download/

Debian Linux 5.0 alpha

• Debian nagios3-common_3.0.6-4~lenny2_all.deb
  http://security.debian.org/pool/updates/main/n/nagios3/nagios3-common_ 3.0.6-4~lenny2_all.deb


• Debian nagios3-dbg_3.0.6-4~lenny2_alpha.deb
  http://security.debian.org/pool/updates/main/n/nagios3/nagios3-dbg_3.0 .6-4~lenny2_alpha.deb


• Debian nagios3-doc_3.0.6-4~lenny2_all.deb
  http://security.debian.org/pool/updates/main/n/nagios3/nagios3-doc_3.0 .6-4~lenny2_all.deb


• Debian nagios3_3.0.6-4~lenny2_alpha.deb
  http://security.debian.org/pool/updates/main/n/nagios3/nagios3_3.0.6-4 ~lenny2_alpha.deb

Debian Linux 5.0 ia-32

• Debian nagios3-common_3.0.6-4~lenny2_all.deb
  http://security.debian.org/pool/updates/main/n/nagios3/nagios3-common_ 3.0.6-4~lenny2_all.deb


• Debian nagios3-dbg_3.0.6-4~lenny2_i386.deb
  http://security.debian.org/pool/updates/main/n/nagios3/nagios3-dbg_3.0 .6-4~lenny2_i386.deb


• Debian nagios3-doc_3.0.6-4~lenny2_all.deb
  http://security.debian.org/pool/updates/main/n/nagios3/nagios3-doc_3.0 .6-4~lenny2_all.deb


• Debian nagios3_3.0.6-4~lenny2_i386.deb
  http://security.debian.org/pool/updates/main/n/nagios3/nagios3_3.0.6-4 ~lenny2_i386.deb

Ubuntu Ubuntu Linux 8.04 LTS amd64

• Ubuntu nagios2-common_2.11-1ubuntu1.5_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/n/nagios2/nagios2-comm on_2.11-1ubuntu1.5_all.deb


• Ubuntu nagios2-dbg_2.11-1ubuntu1.5_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/universe/n/nagios2/nagios2-dbg_ 2.11-1ubuntu1.5_amd64.deb


• Ubuntu nagios2-doc_2.11-1ubuntu1.5_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/n/nagios2/nagios2-doc_ 2.11-1ubuntu1.5_all.deb


• Ubuntu nagios2_2.11-1ubuntu1.5_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/universe/n/nagios2/nagios2_2.11 -1ubuntu1.5_amd64.deb

MandrakeSoft Enterprise Server 5

• Mandriva nagios-3.1.2-0.2mdvmes5.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva nagios-devel-3.1.2-0.2mdvmes5.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva nagios-theme-default-3.1.2-0.2mdvmes5.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva nagios-www-3.1.2-0.2mdvmes5.i586.rpm
  http://www.mandriva.com/en/download/

Debian Linux 5.0 s/390

• Debian nagios3-common_3.0.6-4~lenny2_all.deb
  http://security.debian.org/pool/updates/main/n/nagios3/nagios3-common_ 3.0.6-4~lenny2_all.deb


• Debian nagios3-dbg_3.0.6-4~lenny2_s390.deb
  http://security.debian.org/pool/updates/main/n/nagios3/nagios3-dbg_3.0 .6-4~lenny2_s390.deb


• Debian nagios3-doc_3.0.6-4~lenny2_all.deb
  http://security.debian.org/pool/updates/main/n/nagios3/nagios3-doc_3.0 .6-4~lenny2_all.deb


• Debian nagios3_3.0.6-4~lenny2_s390.deb
  http://security.debian.org/pool/updates/main/n/nagios3/nagios3_3.0.6-4 ~lenny2_s390.deb

Debian Linux 5.0 mipsel

• Debian nagios3-common_3.0.6-4~lenny2_all.deb
  http://security.debian.org/pool/updates/main/n/nagios3/nagios3-common_ 3.0.6-4~lenny2_all.deb


• Debian nagios3-dbg_3.0.6-4~lenny2_mipsel.deb
  http://security.debian.org/pool/updates/main/n/nagios3/nagios3-dbg_3.0 .6-4~lenny2_mipsel.deb


• Debian nagios3-doc_3.0.6-4~lenny2_all.deb
  http://security.debian.org/pool/updates/main/n/nagios3/nagios3-doc_3.0 .6-4~lenny2_all.deb


• Debian nagios3_3.0.6-4~lenny2_mipsel.deb
  http://security.debian.org/pool/updates/main/n/nagios3/nagios3_3.0.6-4 ~lenny2_mipsel.deb

Ubuntu Ubuntu Linux 9.04 sparc

• Ubuntu nagios3-common_3.0.6-2ubuntu1.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/nagios3/nagios3-common_3 .0.6-2ubuntu1.1_all.deb


• Ubuntu nagios3-dbg_3.0.6-2ubuntu1.1_sparc.deb
  http://ports.ubuntu.com/pool/main/n/nagios3/nagios3-dbg_3.0.6-2ubuntu1 .1_sparc.deb


• Ubuntu nagios3-doc_3.0.6-2ubuntu1.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/nagios3/nagios3-doc_3.0. 6-2ubuntu1.1_all.deb


• Ubuntu nagios3_3.0.6-2ubuntu1.1_sparc.deb
  http://ports.ubuntu.com/pool/main/n/nagios3/nagios3_3.0.6-2ubuntu1.1_s parc.deb

Ubuntu Ubuntu Linux 9.04 powerpc

• Ubuntu nagios3-common_3.0.6-2ubuntu1.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/nagios3/nagios3-common_3 .0.6-2ubuntu1.1_all.deb


• Ubuntu nagios3-dbg_3.0.6-2ubuntu1.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/n/nagios3/nagios3-dbg_3.0.6-2ubuntu1 .1_powerpc.deb


• Ubuntu nagios3-doc_3.0.6-2ubuntu1.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/nagios3/nagios3-doc_3.0. 6-2ubuntu1.1_all.deb


• Ubuntu nagios3_3.0.6-2ubuntu1.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/n/nagios3/nagios3_3.0.6-2ubuntu1.1_p owerpc.deb

Ubuntu Ubuntu Linux 8.04 LTS lpia

• Ubuntu nagios2-common_2.11-1ubuntu1.5_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/n/nagios2/nagios2-comm on_2.11-1ubuntu1.5_all.deb


• Ubuntu nagios2-dbg_2.11-1ubuntu1.5_lpia.deb
  http://ports.ubuntu.com/pool/universe/n/nagios2/nagios2-dbg_2.11-1ubun tu1.5_lpia.deb


• Ubuntu nagios2-doc_2.11-1ubuntu1.5_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/n/nagios2/nagios2-doc_ 2.11-1ubuntu1.5_all.deb


• Ubuntu nagios2_2.11-1ubuntu1.5_lpia.deb
  http://ports.ubuntu.com/pool/universe/n/nagios2/nagios2_2.11-1ubuntu1. 5_lpia.deb

Ubuntu Ubuntu Linux 8.10 lpia

• Ubuntu nagios3-common_3.0.2-1ubuntu1.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/nagios3/nagios3-common_3 .0.2-1ubuntu1.2_all.deb


• Ubuntu nagios3-dbg_3.0.2-1ubuntu1.2_lpia.deb
  http://ports.ubuntu.com/pool/main/n/nagios3/nagios3-dbg_3.0.2-1ubuntu1 .2_lpia.deb


• Ubuntu nagios3-doc_3.0.2-1ubuntu1.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/nagios3/nagios3-doc_3.0. 2-1ubuntu1.2_all.deb


• Ubuntu nagios3_3.0.2-1ubuntu1.2_lpia.deb
  http://ports.ubuntu.com/pool/main/n/nagios3/nagios3_3.0.2-1ubuntu1.2_l pia.deb

Debian Linux 5.0 hppa

• Debian nagios3-common_3.0.6-4~lenny2_all.deb
  http://security.debian.org/pool/updates/main/n/nagios3/nagios3-common_ 3.0.6-4~lenny2_all.deb


• Debian nagios3-dbg_3.0.6-4~lenny2_hppa.deb
  http://security.debian.org/pool/updates/main/n/nagios3/nagios3-dbg_3.0 .6-4~lenny2_hppa.deb


• Debian nagios3-doc_3.0.6-4~lenny2_all.deb
  http://security.debian.org/pool/updates/main/n/nagios3/nagios3-doc_3.0 .6-4~lenny2_all.deb


• Debian nagios3_3.0.6-4~lenny2_hppa.deb
  http://security.debian.org/pool/updates/main/n/nagios3/nagios3_3.0.6-4 ~lenny2_hppa.deb

Ubuntu Ubuntu Linux 9.04 i386

• Ubuntu nagios3-common_3.0.6-2ubuntu1.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/nagios3/nagios3-common_3 .0.6-2ubuntu1.1_all.deb


• Ubuntu nagios3-dbg_3.0.6-2ubuntu1.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/nagios3/nagios3-dbg_3.0. 6-2ubuntu1.1_i386.deb


• Ubuntu nagios3-doc_3.0.6-2ubuntu1.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/nagios3/nagios3-doc_3.0. 6-2ubuntu1.1_all.deb


• Ubuntu nagios3_3.0.6-2ubuntu1.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/nagios3/nagios3_3.0.6-2u buntu1.1_i386.deb

Debian Linux 5.0 m68k

• Debian nagios3-common_3.0.6-4~lenny2_all.deb
  http://security.debian.org/pool/updates/main/n/nagios3/nagios3-common_ 3.0.6-4~lenny2_all.deb


• Debian nagios3-doc_3.0.6-4~lenny2_all.deb
  http://security.debian.org/pool/updates/main/n/nagios3/nagios3-doc_3.0 .6-4~lenny2_all.deb

Ubuntu Ubuntu Linux 8.10 sparc

• Ubuntu nagios3-common_3.0.2-1ubuntu1.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/nagios3/nagios3-common_3 .0.2-1ubuntu1.2_all.deb


• Ubuntu nagios3-dbg_3.0.2-1ubuntu1.2_sparc.deb
  http://ports.ubuntu.com/pool/main/n/nagios3/nagios3-dbg_3.0.2-1ubuntu1 .2_sparc.deb


• Ubuntu nagios3-doc_3.0.2-1ubuntu1.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/nagios3/nagios3-doc_3.0. 2-1ubuntu1.2_all.deb


• Ubuntu nagios3_3.0.2-1ubuntu1.2_sparc.deb
  http://ports.ubuntu.com/pool/main/n/nagios3/nagios3_3.0.2-1ubuntu1.2_s parc.deb

Ubuntu Ubuntu Linux 9.04 lpia

• Ubuntu nagios3-common_3.0.6-2ubuntu1.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/nagios3/nagios3-common_3 .0.6-2ubuntu1.1_all.deb


• Ubuntu nagios3-dbg_3.0.6-2ubuntu1.1_lpia.deb
  http://ports.ubuntu.com/pool/main/n/nagios3/nagios3-dbg_3.0.6-2ubuntu1 .1_lpia.deb


• Ubuntu nagios3-doc_3.0.6-2ubuntu1.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/nagios3/nagios3-doc_3.0. 6-2ubuntu1.1_all.deb


• Ubuntu nagios3_3.0.6-2ubuntu1.1_lpia.deb
  http://ports.ubuntu.com/pool/main/n/nagios3/nagios3_3.0.6-2ubuntu1.1_l pia.deb

Debian Linux 5.0 arm

• Debian nagios3-common_3.0.6-4~lenny2_all.deb
  http://security.debian.org/pool/updates/main/n/nagios3/nagios3-common_ 3.0.6-4~lenny2_all.deb


• Debian nagios3-dbg_3.0.6-4~lenny2_arm.deb
  http://security.debian.org/pool/updates/main/n/nagios3/nagios3-dbg_3.0 .6-4~lenny2_arm.deb


• Debian nagios3-doc_3.0.6-4~lenny2_all.deb
  http://security.debian.org/pool/updates/main/n/nagios3/nagios3-doc_3.0 .6-4~lenny2_all.deb


• Debian nagios3_3.0.6-4~lenny2_arm.deb
  http://security.debian.org/pool/updates/main/n/nagios3/nagios3_3.0.6-4 ~lenny2_arm.deb

Debian Linux 5.0 armel

• Debian nagios3-common_3.0.6-4~lenny2_all.deb
  http://security.debian.org/pool/updates/main/n/nagios3/nagios3-common_ 3.0.6-4~lenny2_all.deb


• Debian nagios3-dbg_3.0.6-4~lenny2_armel.deb
  http://security.debian.org/pool/updates/main/n/nagios3/nagios3-dbg_3.0 .6-4~lenny2_armel.deb


• Debian nagios3-doc_3.0.6-4~lenny2_all.deb
  http://security.debian.org/pool/updates/main/n/nagios3/nagios3-doc_3.0 .6-4~lenny2_all.deb


• Debian nagios3_3.0.6-4~lenny2_armel.deb
  http://security.debian.org/pool/updates/main/n/nagios3/nagios3_3.0.6-4 ~lenny2_armel.deb

Debian Linux 5.0

• Debian nagios3-common_3.0.6-4~lenny2_all.deb
  http://security.debian.org/pool/updates/main/n/nagios3/nagios3-common_ 3.0.6-4~lenny2_all.deb


• Debian nagios3-doc_3.0.6-4~lenny2_all.deb
  http://security.debian.org/pool/updates/main/n/nagios3/nagios3-doc_3.0 .6-4~lenny2_all.deb

MandrakeSoft Corporate Server 4.0

• Mandriva nagios-3.1.2-0.1.20060mlcs4.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva nagios-devel-3.1.2-0.1.20060mlcs4.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva nagios-theme-default-3.1.2-0.1.20060mlcs4.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva nagios-www-3.1.2-0.1.20060mlcs4.i586.rpm
  http://www.mandriva.com/en/download/

Nagios Nagios 2.12

• Nagios nagios-3.1.1.tar.gz
  http://prdownloads.sourceforge.net/sourceforge/nagios/nagios-3.1.1.tar .gz

Nagios Nagios 2.11

• Nagios nagios-3.1.1.tar.gz
  http://prdownloads.sourceforge.net/sourceforge/nagios/nagios-3.1.1.tar .gz

Nagios Nagios 2.8

• Nagios nagios-3.1.1.tar.gz
  http://prdownloads.sourceforge.net/sourceforge/nagios/nagios-3.1.1.tar .gz

Ubuntu Ubuntu Linux 8.04 LTS i386

• Ubuntu nagios2-common_2.11-1ubuntu1.5_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/n/nagios2/nagios2-comm on_2.11-1ubuntu1.5_all.deb


• Ubuntu nagios2-dbg_2.11-1ubuntu1.5_i386.deb
  http://security.ubuntu.com/ubuntu/pool/universe/n/nagios2/nagios2-dbg_ 2.11-1ubuntu1.5_i386.deb


• Ubuntu nagios2-doc_2.11-1ubuntu1.5_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/n/nagios2/nagios2-doc_ 2.11-1ubuntu1.5_all.deb


• Ubuntu nagios2_2.11-1ubuntu1.5_i386.deb
  http://security.ubuntu.com/ubuntu/pool/universe/n/nagios2/nagios2_2.11 -1ubuntu1.5_i386.deb

Debian Linux 5.0 amd64

• Debian nagios3-common_3.0.6-4~lenny2_all.deb
  http://security.debian.org/pool/updates/main/n/nagios3/nagios3-common_ 3.0.6-4~lenny2_all.deb


• Debian nagios3-dbg_3.0.6-4~lenny2_amd64.deb
  http://security.debian.org/pool/updates/main/n/nagios3/nagios3-dbg_3.0 .6-4~lenny2_amd64.deb


• Debian nagios3-doc_3.0.6-4~lenny2_all.deb
  http://security.debian.org/pool/updates/main/n/nagios3/nagios3-doc_3.0 .6-4~lenny2_all.deb


• Debian nagios3_3.0.6-4~lenny2_amd64.deb
  http://security.debian.org/pool/updates/main/n/nagios3/nagios3_3.0.6-4 ~lenny2_amd64.deb

Nagios Nagios 2.10

• Nagios nagios-3.1.1.tar.gz
  http://prdownloads.sourceforge.net/sourceforge/nagios/nagios-3.1.1.tar .gz

Debian Linux 5.0 mips

• Debian nagios3-common_3.0.6-4~lenny2_all.deb
  http://security.debian.org/pool/updates/main/n/nagios3/nagios3-common_ 3.0.6-4~lenny2_all.deb


• Debian nagios3-dbg_3.0.6-4~lenny2_mips.deb
  http://security.debian.org/pool/updates/main/n/nagios3/nagios3-dbg_3.0 .6-4~lenny2_mips.deb


• Debian nagios3-doc_3.0.6-4~lenny2_all.deb
  http://security.debian.org/pool/updates/main/n/nagios3/nagios3-doc_3.0 .6-4~lenny2_all.deb


• Debian nagios3_3.0.6-4~lenny2_mips.deb
  http://security.debian.org/pool/updates/main/n/nagios3/nagios3_3.0.6-4 ~lenny2_mips.deb

Ubuntu Ubuntu Linux 9.04 amd64

• Ubuntu nagios3-common_3.0.6-2ubuntu1.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/nagios3/nagios3-common_3 .0.6-2ubuntu1.1_all.deb


• Ubuntu nagios3-dbg_3.0.6-2ubuntu1.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/nagios3/nagios3-dbg_3.0. 6-2ubuntu1.1_amd64.deb


• Ubuntu nagios3-doc_3.0.6-2ubuntu1.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/nagios3/nagios3-doc_3.0. 6-2ubuntu1.1_all.deb


• Ubuntu nagios3_3.0.6-2ubuntu1.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/nagios3/nagios3_3.0.6-2u buntu1.1_amd64.deb

Nagios Nagios 2.9

• Nagios nagios-3.1.1.tar.gz
  http://prdownloads.sourceforge.net/sourceforge/nagios/nagios-3.1.1.tar .gz

Debian Linux 5.0 powerpc

• Debian nagios3-common_3.0.6-4~lenny2_all.deb
  http://security.debian.org/pool/updates/main/n/nagios3/nagios3-common_ 3.0.6-4~lenny2_all.deb


• Debian nagios3-dbg_3.0.6-4~lenny2_powerpc.deb
  http://security.debian.org/pool/updates/main/n/nagios3/nagios3-dbg_3.0 .6-4~lenny2_powerpc.deb


• Debian nagios3-doc_3.0.6-4~lenny2_all.deb
  http://security.debian.org/pool/updates/main/n/nagios3/nagios3-doc_3.0 .6-4~lenny2_all.deb


• Debian nagios3_3.0.6-4~lenny2_powerpc.deb
  http://security.debian.org/pool/updates/main/n/nagios3/nagios3_3.0.6-4 ~lenny2_powerpc.deb

Ubuntu Ubuntu Linux 8.10 amd64

• Ubuntu nagios3-common_3.0.2-1ubuntu1.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/nagios3/nagios3-common_3 .0.2-1ubuntu1.2_all.deb


• Ubuntu nagios3-dbg_3.0.2-1ubuntu1.2_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/nagios3/nagios3-dbg_3.0. 2-1ubuntu1.2_amd64.deb


• Ubuntu nagios3-doc_3.0.2-1ubuntu1.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/nagios3/nagios3-doc_3.0. 2-1ubuntu1.2_all.deb


• Ubuntu nagios3_3.0.2-1ubuntu1.2_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/nagios3/nagios3_3.0.2-1u buntu1.2_amd64.deb

Debian Linux 5.0 sparc

• Debian nagios3-common_3.0.6-4~lenny2_all.deb
  http://security.debian.org/pool/updates/main/n/nagios3/nagios3-common_ 3.0.6-4~lenny2_all.deb


• Debian nagios3-dbg_3.0.6-4~lenny2_sparc.deb
  http://security.debian.org/pool/updates/main/n/nagios3/nagios3-dbg_3.0 .6-4~lenny2_sparc.deb


• Debian nagios3-doc_3.0.6-4~lenny2_all.deb
  http://security.debian.org/pool/updates/main/n/nagios3/nagios3-doc_3.0 .6-4~lenny2_all.deb


• Debian nagios3_3.0.6-4~lenny2_sparc.deb
  http://security.debian.org/pool/updates/main/n/nagios3/nagios3_3.0.6-4 ~lenny2_sparc.deb

Nagios Nagios 2.7

• Nagios nagios-3.1.1.tar.gz
  http://prdownloads.sourceforge.net/sourceforge/nagios/nagios-3.1.1.tar .gz

Nagios Nagios 3.0.4

• Nagios nagios-3.1.1.tar.gz
  http://prdownloads.sourceforge.net/sourceforge/nagios/nagios-3.1.1.tar .gz

Nagios Nagios 3.0.5

• Nagios nagios-3.1.1.tar.gz
  http://prdownloads.sourceforge.net/sourceforge/nagios/nagios-3.1.1.tar .gz

Nagios Nagios 3.0.6

• Nagios nagios-3.1.1.tar.gz
  http://prdownloads.sourceforge.net/sourceforge/nagios/nagios-3.1.1.tar .gz

MandrakeSoft Corporate Server 4.0 x86_64

• Mandriva nagios-3.1.2-0.1.20060mlcs4.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva nagios-devel-3.1.2-0.1.20060mlcs4.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva nagios-theme-default-3.1.2-0.1.20060mlcs4.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva nagios-www-3.1.2-0.1.20060mlcs4.x86_64.rpm
  http://www.mandriva.com/en/download/

Nagios 'statuswml.cgi' Remote Arbitrary Shell Command Injection Vulnerability

References:

• 0000015: Nagios Security Issue (Nagios)
  
• Nagios 3 Changelog (Nagios)
  
• Nagios Homepage (Nagios)
  
• [security bulletin] HPSBMA02513 SSRT090110 rev.1 - Insight Control for Linux (IC ([email protected])