Monit Overly Long HTTP Request Buffer Overrun Vulnerability
BID:9099
Info
Monit Overly Long HTTP Request Buffer Overrun Vulnerability
| Bugtraq ID: | 9099 |
| Class: | Boundary Condition Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 24 2003 12:00AM |
| Updated: | Nov 24 2003 12:00AM |
| Credit: | The discovery of this vulnerability is credited to Evgeny Legerov <[email protected]>. |
| Vulnerable: |
TildeSlash Monit 4.1 TildeSlash Monit 4.0 TildeSlash Monit 3.2 TildeSlash Monit 3.1 TildeSlash Monit 3.0 TildeSlash Monit 2.4.3 TildeSlash Monit 2.4.2 TildeSlash Monit 2.4.1 TildeSlash Monit 2.4 TildeSlash Monit 2.3 TildeSlash Monit 2.2.1 TildeSlash Monit 2.2 TildeSlash Monit 2.1.1 TildeSlash Monit 2.1 TildeSlash Monit 2.0 TildeSlash Monit 1.4.1 TildeSlash Monit 1.4 |
| Not Vulnerable: |
TildeSlash Monit 4.1.1 TildeSlash Monit 1.3.1 TildeSlash Monit 1.3 TildeSlash Monit 1.2 TildeSlash Monit 1.1 TildeSlash Monit 1.0 |
Discussion
Monit Overly Long HTTP Request Buffer Overrun Vulnerability
A buffer overrun vulnerability has been discovered in Monit 4.1 and earlier that could be exploited remotely to gain root privileges. The problem occurs due to insufficient bounds checking when handling overly long HTTP requests. As a result, it may be possible for a remote attacker to corrupt sensitive process data in such a way that the execution flow of Monit can be controlled.
Successful exploitation of this condition could potentially allow for the execution of arbitrary code with root privileges.
A buffer overrun vulnerability has been discovered in Monit 4.1 and earlier that could be exploited remotely to gain root privileges. The problem occurs due to insufficient bounds checking when handling overly long HTTP requests. As a result, it may be possible for a remote attacker to corrupt sensitive process data in such a way that the execution flow of Monit can be controlled.
Successful exploitation of this condition could potentially allow for the execution of arbitrary code with root privileges.
Exploit / POC
Monit Overly Long HTTP Request Buffer Overrun Vulnerability
Proof of concept has been submitted by gsicht gsicht <[email protected]>.
Exploit code has been provided by Michel Blomgren <[email protected]>.
Proof of concept has been submitted by gsicht gsicht <[email protected]>.
Exploit code has been provided by Michel Blomgren <[email protected]>.
Solution / Fix
Monit Overly Long HTTP Request Buffer Overrun Vulnerability
Solution:
The vendor has release Monit 4.1.1 to address this issue in affected versions. Users are advised to upgrade to the latest version as soon as possible.
Gentoo has released an advisory GLSA 200403-14 to address this and another issue in Monit. Please see the referenced advisory for more information. Gentoo users may carry out the following commands to upgrade to Monit version 4.2:
# emerge sync
# emerge -pv ">=app-admin/monit-4.2"
# emerge ">=app-admin/monit-4.2"
TildeSlash Monit 1.4
TildeSlash Monit 1.4.1
TildeSlash Monit 2.0
TildeSlash Monit 2.1
TildeSlash Monit 2.1.1
TildeSlash Monit 2.2
TildeSlash Monit 2.2.1
TildeSlash Monit 2.3
TildeSlash Monit 2.4
TildeSlash Monit 2.4.1
TildeSlash Monit 2.4.2
TildeSlash Monit 2.4.3
TildeSlash Monit 3.0
TildeSlash Monit 3.1
TildeSlash Monit 3.2
TildeSlash Monit 4.0
TildeSlash Monit 4.1
Solution:
The vendor has release Monit 4.1.1 to address this issue in affected versions. Users are advised to upgrade to the latest version as soon as possible.
Gentoo has released an advisory GLSA 200403-14 to address this and another issue in Monit. Please see the referenced advisory for more information. Gentoo users may carry out the following commands to upgrade to Monit version 4.2:
# emerge sync
# emerge -pv ">=app-admin/monit-4.2"
# emerge ">=app-admin/monit-4.2"
TildeSlash Monit 1.4
-
TildeSlash Monit 4.1.1
http://www.tildeslash.com/monit/dist/monit-4.1.1.tar.gz
TildeSlash Monit 1.4.1
-
TildeSlash Monit 4.1.1
http://www.tildeslash.com/monit/dist/monit-4.1.1.tar.gz
TildeSlash Monit 2.0
-
TildeSlash Monit 4.1.1
http://www.tildeslash.com/monit/dist/monit-4.1.1.tar.gz
TildeSlash Monit 2.1
-
TildeSlash Monit 4.1.1
http://www.tildeslash.com/monit/dist/monit-4.1.1.tar.gz
TildeSlash Monit 2.1.1
-
TildeSlash Monit 4.1.1
http://www.tildeslash.com/monit/dist/monit-4.1.1.tar.gz
TildeSlash Monit 2.2
-
TildeSlash Monit 4.1.1
http://www.tildeslash.com/monit/dist/monit-4.1.1.tar.gz
TildeSlash Monit 2.2.1
-
TildeSlash Monit 4.1.1
http://www.tildeslash.com/monit/dist/monit-4.1.1.tar.gz
TildeSlash Monit 2.3
-
TildeSlash Monit 4.1.1
http://www.tildeslash.com/monit/dist/monit-4.1.1.tar.gz
TildeSlash Monit 2.4
-
TildeSlash Monit 4.1.1
http://www.tildeslash.com/monit/dist/monit-4.1.1.tar.gz
TildeSlash Monit 2.4.1
-
TildeSlash Monit 4.1.1
http://www.tildeslash.com/monit/dist/monit-4.1.1.tar.gz
TildeSlash Monit 2.4.2
-
TildeSlash Monit 4.1.1
http://www.tildeslash.com/monit/dist/monit-4.1.1.tar.gz
TildeSlash Monit 2.4.3
-
TildeSlash Monit 4.1.1
http://www.tildeslash.com/monit/dist/monit-4.1.1.tar.gz
TildeSlash Monit 3.0
-
TildeSlash Monit 4.1.1
http://www.tildeslash.com/monit/dist/monit-4.1.1.tar.gz
TildeSlash Monit 3.1
-
TildeSlash Monit 4.1.1
http://www.tildeslash.com/monit/dist/monit-4.1.1.tar.gz
TildeSlash Monit 3.2
-
TildeSlash Monit 4.1.1
http://www.tildeslash.com/monit/dist/monit-4.1.1.tar.gz
TildeSlash Monit 4.0
-
TildeSlash Monit 4.1.1
http://www.tildeslash.com/monit/dist/monit-4.1.1.tar.gz
TildeSlash Monit 4.1
-
TildeSlash Monit 4.1.1
http://www.tildeslash.com/monit/dist/monit-4.1.1.tar.gz
References
Monit Overly Long HTTP Request Buffer Overrun Vulnerability
References:
References:
- Monit Product Changelog (TildeSlash)
- Monit Product Page (TildeSlash)
- Monit 4.1 HTTP interface multiple security vulnerabilities (S-Quadra Security Research
) - monit 4.1 POC (gsicht gsicht
)