CVE-2008-5028

Publication date 10 November 2008

Last updated 24 July 2024

Ubuntu priority

Cross-site request forgery (CSRF) vulnerability in cmd.cgi in (1) Nagios 3.0.5 and (2) op5 Monitor before 4.0.1 allows remote attackers to send commands to the Nagios process, and trigger execution of arbitrary programs by this process, via unspecified HTTP requests.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
nagios	8.10 intrepid	Not in release
	8.04 LTS hardy	Not in release
	7.10 gutsy	Not affected
	6.06 LTS dapper	Not affected
nagios2	8.10 intrepid	Not in release
	8.04 LTS hardy	Fixed 2.11-1ubuntu1.4
	7.10 gutsy	Ignored end of life, was needed
	6.06 LTS dapper	Not in release
nagios3	8.10 intrepid	Fixed 3.0.2-1ubuntu1.1
	8.04 LTS hardy	Not in release
	7.10 gutsy	Not in release
	6.06 LTS dapper	Not in release

Notes

mdeslaur

Nagios 1.x doesn't have the CMD_CHANGE commands, so remote attackers wouldn't be able to trigger arbitrary programs.

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
nagios3	Upstream: http://git.op5.org/git/?p=nagios.git;a=commitdiff;h=9c2a418ab4f6e4ef3a53ddcde402fe4781caa764 Upstream: http://nagios.cvs.sourceforge.net/viewvc/nagios/nagios/base/commands.c?r1=1.109&r2=1.110

CVE-2008-5028

Status

Notes

mdeslaur

Patch details

References

Related Ubuntu Security Notices (USN)

Other references