Centreon and Centreon Enterprise Server CVE-2014-3829 Remote Command Execution Vulnerability

Bugtraq ID:	70649
Class:	Input Validation Error
CVE:	CVE-2014-3829
Remote:	Yes
Local:	No
Published:	Oct 15 2014 12:00AM
Updated:	Oct 31 2014 12:59AM
Credit:	MaZ
Vulnerable:	Centreon Centreon 2.3.2 Centreon Centreon 2.3.1 Centreon Centreon 2.1.5 Centreon Centreon 2.1.4 Centreon Centreon 2.1.3 Centreon Centreon 2.1.2 Centreon Centreon 2.1.1 Centreon Centreon 2.0.2 Centreon Centreon 2.0.1 Centreon Centreon 1.4.2 .4 Centreon Centreon 1.4.1 Centreon Centreon 2.0.RC5 Centreon Centreon 2.0.RC4 Centreon Centreon 2.0.RC3 Centreon Centreon 2.0.RC2 Centreon Centreon 2.0.RC1 Centreon Centreon 2.0 Centreon Centreon 1.4.2.3 Centreon Centreon 1.4.2.2 Centreon Centreon 1.4
Not Vulnerable:

Centreon and Centreon Enterprise Server CVE-2014-3829 Remote Command Execution Vulnerability

Centreon and Centreon Enterprise Server are prone to a remote command-injection vulnerability.

Attackers can exploit this issue to execute arbitrary commands in the context of the application.

The following products are vulnerable:

Centreon 2.5.1 and prior versions
Centreon Enterprise Server 2.2 and prior versions

Centreon and Centreon Enterprise Server CVE-2014-3829 Remote Command Execution Vulnerability

Attackers can exploit this issue through a browser.

The following metasploit module is available:

• /data/vulnerabilities/exploits/70649.rb

Centreon and Centreon Enterprise Server CVE-2014-3829 Remote Command Execution Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Centreon and Centreon Enterprise Server CVE-2014-3829 Remote Command Execution Vulnerability

References:

• centreon Homepage (centreon)