Bug 1405363 (CVE-2016-9565)

Summary: CVE-2016-9565 nagios: Command injection via curl in MagpieRSS
Product: [Other] Security Response Reporter: Adam Mariš <amaris>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: affix, apevec, avibelli, chrisw, cvsbot-xmlrpc, gsterlin, jbalunas, jose.p.oliveira.oss, jschluet, jshepherd, kbasil, lemenkov, lhh, linux, lpeer, markmc, mmagr, ondrejj, rbryant, rcyriac, rhs-bugs, rrajasek, sclewis, sgirijan, shawn.starr, sisharma, smooge, smooge, srevivo, ssaha, s, storage-qa-internal, swilkerson, tdecacqu, tkirby, vbellur
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: nagios 4.2.2 Doc Type: Bug Fix
Doc Text:
It was found that an attacker who could control the content of an RSS feed could execute code remotely using the Nagios web interface. This flaw could be used to gain access to the remote system and in some scenarios control over the system.
Story Points: ---
Clone Of: Environment:
Last Closed: 2019-06-08 03:04:32 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1405364, 1405365, 1406780, 1413480, 1413481, 1413482, 1413483    
Bug Blocks: 1405372, 1415899    

Description Adam Mariš 2016-12-16 10:14:14 UTC
MagpieRSS, a component for handling RSS news feeds in Nagios Core control panel / front-end, was found vulnerable to command injection due to insufficient neutralization of special elements in function _httpsrequest().

The vulnerability could potentially enable remote unauthenticated attackers who  managed to impersonate the feed server (via DNS poisoning, domain hijacking, ARP spoofing etc.), to provide a malicious response that injects parameters to curl command used by the affected RSS client class and effectively read/write arbitrary files on the vulnerable Nagios server. This could lead to Remote Code Execution in the context of www-data/nagios user on default Nagios installs that follow the official setup guidelines.

This issue is due to incomplete fix of CVE-2008-4796.

External References:

https://legalhackers.com/advisories/Nagios-Exploit-Command-Injection-CVE-2016-9565-2008-4796.html

Comment 1 Adam Mariš 2016-12-16 10:15:44 UTC
Created nagios tracking bugs for this issue:

Affects: fedora-all [bug 1405364]
Affects: epel-all [bug 1405365]

Comment 2 Jason Shepherd 2016-12-21 00:26:25 UTC
I looked at this in relation to Nagios 4.0.8 and found that Snoopy's fetch funtion is used by rss_fetch in Nagios. The 'rss_fetch' method in 'rss_fetch.inc' is called by various php files in Nagios, but doesn't except user input to the request. Setting RHMAP as wontfix as a consequence.

Comment 4 Andrej Nemec 2016-12-21 09:02:16 UTC
References:

http://seclists.org/oss-sec/2016/q4/714

Comment 6 Siddharth Sharma 2016-12-21 14:55:50 UTC
Mitigation:

#!/bin/bash

mv /usr/share/nagios/html/includes/rss /usr/share/nagios/html/includes/rss.disarmed
mv /usr/share/nagios/html/rss-corefeed.php /usr/share/nagios/html/rss-corefeed.php.disarmed
mv /usr/share/nagios/html/rss-newsfeed.php /usr/share/nagios/html/rss-newsfeed.php.disarmed

This should disable rss from nagios installation and stop affected php code from being executed. Only downside to this would be news widget wont fetch any data from nagios.org rss feeds.

Comment 7 Siddharth Sharma 2016-12-21 15:59:40 UTC
Nagios is shipped with Red Hat Gluster Storage 3.1, Red Hat Openstack 5,6,7, and 
Red Hat Mobile Application Platform 4. We are currently investigating for 
solutions. In the mean time please apply mitigation as mentioned in 
https://bugzilla.redhat.com/show_bug.cgi?id=1405363#c6
which will disable affected PHP code from execution.

Comment 8 Tomas Hoger 2016-12-21 22:05:39 UTC
This issue is actually in Snoopy - a PHP class for fetching web pages:

https://sourceforge.net/projects/snoopy/

Snoopy is embedded in MagpieRSS, which is embedded in nagios.

The issue was fixed in Snoopy upstream by changing it to use native PHP functions to fetch web pages instead of using curl:

http://snoopy.cvs.sourceforge.net/viewvc/snoopy/Snoopy/Snoopy.class.php?view=log#rev1.29

Nagios upstream fixed the problem in version 4.2.2 by removing MagpieRSS and hence Snoopy:

https://github.com/NagiosEnterprises/nagioscore/commit/f0808f9c2aca777685ba57e71a8cd7b4baa8aa78

Note that this CVE is actually a dupe of CVE-2014-5008 (bug 1121497).

Comment 11 Stephen John Smoogen 2017-01-16 17:26:09 UTC
Current status:
This package does not have an active maintainer. I am working on an updated replacement package which fixes these problems but need some reviews and help to make it work on Fedora 24/25 and help with selinux policy to get it ready to put into the 'stream'.

The updated replacement package is at:

https://copr.fedorainfracloud.org/coprs/smooge/Nagios_Update/

I do not know if this fixes the security bug so I need help here also.

Comment 12 Scott Wilkerson 2017-01-16 18:29:34 UTC
Stephen,

your copr package should fix the vulnerability as they should be all fixed as of Nagios 4.2.4.

Comment 15 errata-xmlrpc 2017-01-31 05:53:53 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7

Via RHSA-2017:0214 https://rhn.redhat.com/errata/RHSA-2017-0214.html

Comment 16 errata-xmlrpc 2017-01-31 05:55:15 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7

Via RHSA-2017:0213 https://rhn.redhat.com/errata/RHSA-2017-0213.html

Comment 17 errata-xmlrpc 2017-01-31 05:56:37 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6

Via RHSA-2017:0212 https://rhn.redhat.com/errata/RHSA-2017-0212.html

Comment 18 errata-xmlrpc 2017-01-31 05:58:10 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7

Via RHSA-2017:0211 https://rhn.redhat.com/errata/RHSA-2017-0211.html

Comment 19 errata-xmlrpc 2017-02-07 11:17:07 UTC
This issue has been addressed in the following products:

  Red Hat Gluster Storage 3.1 for RHEL 6

Via RHSA-2017:0259 https://rhn.redhat.com/errata/RHSA-2017-0259.html

Comment 20 errata-xmlrpc 2017-02-07 11:18:04 UTC
This issue has been addressed in the following products:

  Red Hat Gluster Storage 3.1 for RHEL 7

Via RHSA-2017:0258 https://rhn.redhat.com/errata/RHSA-2017-0258.html