BID:9098

Monit HTTP Content-Length Parameter Denial of Service Vulnerability

Info

Monit HTTP Content-Length Parameter Denial of Service Vulnerability

Bugtraq ID:	9098
Class:	Failure to Handle Exceptional Conditions
CVE:
Remote:	Yes
Local:	No
Published:	Nov 24 2003 12:00AM
Updated:	Nov 24 2003 12:00AM
Credit:	The discovery of this vulnerability is credited to Evgeny Legerov <[email protected]>.
Vulnerable:	TildeSlash Monit 4.1 TildeSlash Monit 4.0 TildeSlash Monit 3.2 TildeSlash Monit 3.1 TildeSlash Monit 3.0 TildeSlash Monit 2.4.3 TildeSlash Monit 2.4.2 TildeSlash Monit 2.4.1 TildeSlash Monit 2.4 TildeSlash Monit 2.3 TildeSlash Monit 2.2.1 TildeSlash Monit 2.2 TildeSlash Monit 2.1.1 TildeSlash Monit 2.1 TildeSlash Monit 2.0 TildeSlash Monit 1.4.1 TildeSlash Monit 1.4

Not Vulnerable:	TildeSlash Monit 4.1.1 TildeSlash Monit 1.3.1 TildeSlash Monit 1.3 TildeSlash Monit 1.2 TildeSlash Monit 1.1 TildeSlash Monit 1.0

Discussion

Monit HTTP Content-Length Parameter Denial of Service Vulnerability

A denial of service vulnerability has been discovered in Monit 4.1 and earlier that may be trivially exploited by an anonymous attacker. The problem is said to occur due to Monit's failure to sanitize remotely supplied HTTP parameters before passing them to memory allocation functions. This could result in an unexpected condition that could ultimately result in the Monit daemon crashing.

Exploit / POC

Monit HTTP Content-Length Parameter Denial of Service Vulnerability

The researchers who discovered this issue have developed an exploit however it has not been available to the public.

Solution / Fix

Monit HTTP Content-Length Parameter Denial of Service Vulnerability

Solution:
The vendor has release Monit 4.1.1 to address this issue in affected versions. Users are advised to upgrade to the latest version as soon as possible.

Gentoo has released an advisory GLSA 200403-14 to address this and another issue in Monit. Please see the referenced advisory for more information. Gentoo users may carry out the following commands to upgrade to Monit version 4.2:

# emerge sync
# emerge -pv ">=app-admin/monit-4.2"
# emerge ">=app-admin/monit-4.2"

TildeSlash Monit 1.4