Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.
First Last Prev Next    This bug is not in your last search results.
Bug 1121497 - (CVE-2008-7313, CVE-2014-5008, CVE-2014-5009) CVE-2008-7313 CVE-2014-5008 CVE-2014-5009 snoopy: incomplete fixes for command execution flaws
CVE-2008-7313 CVE-2014-5008 CVE-2014-5009 snoopy: incomplete fixes for comman...
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
high Severity high
: ---
: ---
Assigned To: Red Hat Product Security
impact=important,public=20140703,repo...
: Reopened, Security
Depends On: 1121499 1121500 1121501 1121502 1121503 1413480 1413481 1413482 1413483
Blocks: 1121504
  Show dependency tree / graph
 
Reported: 2014-07-21 02:11 EDT by Murray McAllister
Modified: 2017-02-01 03:18 EST (History)
34 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Various command-execution flaws were found in the Snoopy library included with Nagios. These flaws allowed remote attackers to execute arbitrary commands by manipulating Nagios HTTP headers.
Story Points: ---
Clone Of:
Environment:
Last Closed: 2017-01-31 17:35:14 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2017:0211 normal SHIPPED_LIVE Important: nagios security update 2017-01-31 05:53:01 EST
Red Hat Product Errata RHSA-2017:0212 normal SHIPPED_LIVE Important: nagios security update 2017-01-31 05:52:41 EST
Red Hat Product Errata RHSA-2017:0213 normal SHIPPED_LIVE Important: nagios security update 2017-01-31 05:52:24 EST
Red Hat Product Errata RHSA-2017:0214 normal SHIPPED_LIVE Important: nagios security update 2017-01-31 05:52:08 EST

  None (edit)
Description Murray McAllister 2014-07-21 02:11:00 EDT 
CVE-2008-4796 describes a command execution flaw in the Snoopy library. A similar fix exists for headers:

http://snoopy.cvs.sourceforge.net/viewvc/snoopy/Snoopy/Snoopy.class.php?view=log#rev1.27

The header fix has been assigned CVE-2008-7313 (as an incomplete fix for CVE-2008-4796).

It was later reported that the CVE-2008-4796 fix was incomplete and command execution was still possible:

http://mstrokin.com/sec/feed2js-magpierss-0day-vulnerability-not-really-it-is-actually-cve-2005-3330-cve-2008-4796/

And fixed with the following:

http://snoopy.cvs.sourceforge.net/viewvc/snoopy/Snoopy/Snoopy.class.php?view=log#rev1.28

This has been assigned CVE-2014-5008 (as an incomplete fix for CVE-2008-4796).

However, the CVE-2014-5008 fix was also incomplete:

https://github.com/cogdog/feed2js/pull/12#issuecomment-48283706

This was fixed with the following:

http://snoopy.cvs.sourceforge.net/viewvc/snoopy/Snoopy/Snoopy.class.php?view=log#rev1.29

And assigned CVE-2014-5009 (as an incomplete fix for CVE-2014-5008).

References:

http://www.openwall.com/lists/oss-security/2014/07/09/11
Comment 1 Murray McAllister 2014-07-21 02:12:01 EDT 
> This was fixed with the following:
> 
> http://snoopy.cvs.sourceforge.net/viewvc/snoopy/Snoopy/Snoopy.class.
> php?view=log#rev1.29

and further corrected in the subsequent commits

> 
> And assigned CVE-2014-5009 (as an incomplete fix for CVE-2014-5008).
Comment 2 Murray McAllister 2014-07-21 02:14:34 EDT 
Created sahana tracking bugs for this issue:

Affects: fedora-all [bug 1121501]
Affects: epel-5 [bug 1121502]
Comment 3 Murray McAllister 2014-07-21 02:14:40 EDT 
Created wordpress-mu tracking bugs for this issue:

Affects: epel-5 [bug 1121503]
Comment 4 Murray McAllister 2014-07-21 02:14:46 EDT 
Created nagios tracking bugs for this issue:

Affects: fedora-all [bug 1121499]
Affects: epel-all [bug 1121500]
Comment 5 Garth Mollett 2014-08-04 02:29:46 EDT 
Nagios as included in storage and openstack does not appear to expose the vulnerable code.

There is example code in the nagios src package that is vulnerable but it is not included in the built packages.

There is only 2 places that the vulnerable code is reached in nagios:

1. rss-corefeed.php:

18 function do_corefeed_html() {
19 
20         $url="http://www.nagios.org/backend/feeds/corepromo";
21         $rss=fetch_rss($url);


2. rss-newsfeed.php:

16 function do_newsfeed_html() {
17 
18         $url="http://www.nagios.org/backend/feeds/frontpage/";
19         $rss=fetch_rss($url);

Neither of these accept anything but static input.
Comment 7 Summer Long 2017-01-30 18:56:53 EST 
This is now being fixed; reopening.
Comment 9 errata-xmlrpc 2017-01-31 00:53:23 EST 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7

Via RHSA-2017:0214 https://rhn.redhat.com/errata/RHSA-2017-0214.html
Comment 10 errata-xmlrpc 2017-01-31 00:54:47 EST 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7

Via RHSA-2017:0213 https://rhn.redhat.com/errata/RHSA-2017-0213.html
Comment 11 errata-xmlrpc 2017-01-31 00:56:05 EST 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6

Via RHSA-2017:0212 https://rhn.redhat.com/errata/RHSA-2017-0212.html
Comment 12 errata-xmlrpc 2017-01-31 00:57:36 EST 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7

Via RHSA-2017:0211 https://rhn.redhat.com/errata/RHSA-2017-0211.html
Note You need to log in before you can comment on or make changes to this bug.
First Last Prev Next    This bug is not in your last search results.