CVE

Id
67055  
CVE No.
CVE-2013-7108  
Status
Candidate  
Description
Multiple off-by-one errors in Nagios Core 3.5.1, 4.0.2, and earlier, and Icinga before 1.8.5, 1.9 before 1.9.4, and 1.10 before 1.10.2 allow remote authenticated users to obtain sensitive information from process memory or cause a denial of service (crash) via a long string in the last key value in the variable list to the process_cgivars function in (1) avail.c, (2) cmd.c, (3) config.c, (4) extinfo.c, (5) histogram.c, (6) notifications.c, (7) outages.c, (8) status.c, (9) statusmap.c, (10) summary.c, and (11) trends.c in cgi/, which triggers a heap-based buffer over-read.  
Phase
Assigned (20131215)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
648117 67055 CVE-2013-7108 MLIST:[oss-security] 20131224 Re: CVE request: denial of service in Nagios (process_cgivars())  View
648118 67055 CVE-2013-7108 URL:http://www.openwall.com/lists/oss-security/2013/12/24/1  View
648119 67055 CVE-2013-7108 CONFIRM:http://sourceforge.net/p/nagios/nagioscore/ci/d97e03f32741a7d851826b03ed73ff4c9612a866/  View
648120 67055 CVE-2013-7108 CONFIRM:https://dev.icinga.org/issues/5251  View
648121 67055 CVE-2013-7108 CONFIRM:https://www.icinga.org/2013/12/17/icinga-security-releases-1-10-2-1-9-4-1-8-5/  View
648122 67055 CVE-2013-7108 MANDRIVA:MDVSA-2014:004  View
648123 67055 CVE-2013-7108 URL:http://www.mandriva.com/security/advisories?name=MDVSA-2014:004  View
648124 67055 CVE-2013-7108 SUSE:openSUSE-SU-2014:0016  View
648125 67055 CVE-2013-7108 URL:http://lists.opensuse.org/opensuse-updates/2014-01/msg00010.html  View
648126 67055 CVE-2013-7108 SUSE:openSUSE-SU-2014:0039  View
648127 67055 CVE-2013-7108 URL:http://lists.opensuse.org/opensuse-updates/2014-01/msg00028.html  View
648128 67055 CVE-2013-7108 SUSE:openSUSE-SU-2014:0069  View
648129 67055 CVE-2013-7108 URL:http://lists.opensuse.org/opensuse-updates/2014-01/msg00046.html  View
648130 67055 CVE-2013-7108 SUSE:openSUSE-SU-2014:0097  View
648131 67055 CVE-2013-7108 URL:http://lists.opensuse.org/opensuse-updates/2014-01/msg00068.html  View
648132 67055 CVE-2013-7108 BID:64363  View
648133 67055 CVE-2013-7108 URL:http://www.securityfocus.com/bid/64363  View
648134 67055 CVE-2013-7108 SECUNIA:55976  View
648135 67055 CVE-2013-7108 URL:http://secunia.com/advisories/55976  View
648136 67055 CVE-2013-7108 SECUNIA:56316  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
24054 JVNDB-2013-005629 Wireshark の BSSGP 解析機能の epan/dissectors/packet-bssgp.c におけるサービス運用妨害 (DoS) の脆弱性 Wireshark の BSSGP 解析機能の epan/dissectors/packet-bssgp.c は、誤ってグローバル変数を信頼するため、サービス運用妨害 (アプリケーションクラッシュ) 状態にされる脆弱性が存在します。 CVE-2013-7113 67055 5 http://jvndb.jvn.jp/ja/contents/2013/JVNDB-2013-005629.html  View