Bug 1405363 (CVE-2016-9565)
Summary: | CVE-2016-9565 nagios: Command injection via curl in MagpieRSS | ||
---|---|---|---|
Product: | [Other] Security Response | Reporter: | Adam Mariš <amaris> |
Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
Status: | CLOSED ERRATA | QA Contact: | |
Severity: | high | Docs Contact: | |
Priority: | high | ||
Version: | unspecified | CC: | affix, apevec, avibelli, chrisw, cvsbot-xmlrpc, gsterlin, jbalunas, jose.p.oliveira.oss, jschluet, jshepherd, kbasil, lemenkov, lhh, linux, lpeer, markmc, mmagr, ondrejj, rbryant, rcyriac, rhs-bugs, rrajasek, sclewis, sgirijan, shawn.starr, sisharma, smooge, smooge, srevivo, ssaha, s, storage-qa-internal, swilkerson, tdecacqu, tkirby, vbellur |
Target Milestone: | --- | Keywords: | Security |
Target Release: | --- | ||
Hardware: | All | ||
OS: | Linux | ||
Whiteboard: | |||
Fixed In Version: | nagios 4.2.2 | Doc Type: | Bug Fix |
Doc Text: |
It was found that an attacker who could control the content of an RSS feed could execute code remotely using the Nagios web interface. This flaw could be used to gain access to the remote system and in some scenarios control over the system.
|
Story Points: | --- |
Clone Of: | Environment: | ||
Last Closed: | 2019-06-08 03:04:32 UTC | Type: | --- |
Regression: | --- | Mount Type: | --- |
Documentation: | --- | CRM: | |
Verified Versions: | Category: | --- | |
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
Cloudforms Team: | --- | Target Upstream Version: | |
Embargoed: | |||
Bug Depends On: | 1405364, 1405365, 1406780, 1413480, 1413481, 1413482, 1413483 | ||
Bug Blocks: | 1405372, 1415899 |
Description
Adam Mariš
2016-12-16 10:14:14 UTC
Created nagios tracking bugs for this issue: Affects: fedora-all [bug 1405364] Affects: epel-all [bug 1405365] I looked at this in relation to Nagios 4.0.8 and found that Snoopy's fetch funtion is used by rss_fetch in Nagios. The 'rss_fetch' method in 'rss_fetch.inc' is called by various php files in Nagios, but doesn't except user input to the request. Setting RHMAP as wontfix as a consequence. References: http://seclists.org/oss-sec/2016/q4/714 Mitigation: #!/bin/bash mv /usr/share/nagios/html/includes/rss /usr/share/nagios/html/includes/rss.disarmed mv /usr/share/nagios/html/rss-corefeed.php /usr/share/nagios/html/rss-corefeed.php.disarmed mv /usr/share/nagios/html/rss-newsfeed.php /usr/share/nagios/html/rss-newsfeed.php.disarmed This should disable rss from nagios installation and stop affected php code from being executed. Only downside to this would be news widget wont fetch any data from nagios.org rss feeds. Nagios is shipped with Red Hat Gluster Storage 3.1, Red Hat Openstack 5,6,7, and Red Hat Mobile Application Platform 4. We are currently investigating for solutions. In the mean time please apply mitigation as mentioned in https://bugzilla.redhat.com/show_bug.cgi?id=1405363#c6 which will disable affected PHP code from execution. This issue is actually in Snoopy - a PHP class for fetching web pages: https://sourceforge.net/projects/snoopy/ Snoopy is embedded in MagpieRSS, which is embedded in nagios. The issue was fixed in Snoopy upstream by changing it to use native PHP functions to fetch web pages instead of using curl: http://snoopy.cvs.sourceforge.net/viewvc/snoopy/Snoopy/Snoopy.class.php?view=log#rev1.29 Nagios upstream fixed the problem in version 4.2.2 by removing MagpieRSS and hence Snoopy: https://github.com/NagiosEnterprises/nagioscore/commit/f0808f9c2aca777685ba57e71a8cd7b4baa8aa78 Note that this CVE is actually a dupe of CVE-2014-5008 (bug 1121497). Current status: This package does not have an active maintainer. I am working on an updated replacement package which fixes these problems but need some reviews and help to make it work on Fedora 24/25 and help with selinux policy to get it ready to put into the 'stream'. The updated replacement package is at: https://copr.fedorainfracloud.org/coprs/smooge/Nagios_Update/ I do not know if this fixes the security bug so I need help here also. Stephen, your copr package should fix the vulnerability as they should be all fixed as of Nagios 4.2.4. This issue has been addressed in the following products: Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7 Via RHSA-2017:0214 https://rhn.redhat.com/errata/RHSA-2017-0214.html This issue has been addressed in the following products: Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7 Via RHSA-2017:0213 https://rhn.redhat.com/errata/RHSA-2017-0213.html This issue has been addressed in the following products: Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6 Via RHSA-2017:0212 https://rhn.redhat.com/errata/RHSA-2017-0212.html This issue has been addressed in the following products: Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7 Via RHSA-2017:0211 https://rhn.redhat.com/errata/RHSA-2017-0211.html This issue has been addressed in the following products: Red Hat Gluster Storage 3.1 for RHEL 6 Via RHSA-2017:0259 https://rhn.redhat.com/errata/RHSA-2017-0259.html This issue has been addressed in the following products: Red Hat Gluster Storage 3.1 for RHEL 7 Via RHSA-2017:0258 https://rhn.redhat.com/errata/RHSA-2017-0258.html |