Check_MK File Processing Arbitrary File Disclosure Vulnerability

Bugtraq ID:	67674
Class:	Design Error
CVE:	CVE-2014-0243
Remote:	No
Local:	Yes
Published:	May 28 2014 12:00AM
Updated:	May 28 2014 12:00AM
Credit:	Markus Vervier and Sascha Kettler of LSE Leading Security Experts GmbH
Vulnerable:
Not Vulnerable:

Check_MK File Processing Arbitrary File Disclosure Vulnerability

Check_MK is prone to an arbitrary file-disclosure vulnerability because it fails to adequately validate user-supplied input.

Exploiting this vulnerability could allow an attacker to obtain potentially sensitive information from local files on computers running the vulnerable application. This may aid in further attacks.

Check_MK 1.2.5i2p1 and prior are vulnerable.

Check_MK File Processing Arbitrary File Disclosure Vulnerability

Attackers may be able to perform symbolic-link attacks to read arbitrary files in the context of the affected application. Other attacks may also be possible.

Check_MK File Processing Arbitrary File Disclosure Vulnerability

Solution:
Reportedly the issue is fixed, however Symantec has not confirmed this. Please contact the vendor for more information.

Check_MK File Processing Arbitrary File Disclosure Vulnerability

References: