Red Hat Bugzilla – Bug 1405363
CVE-2016-9565 nagios: Command injection via curl in MagpieRSS
Last modified: 2018-05-09 11:44:43 EDT
MagpieRSS, a component for handling RSS news feeds in Nagios Core control panel / front-end, was found vulnerable to command injection due to insufficient neutralization of special elements in function _httpsrequest(). The vulnerability could potentially enable remote unauthenticated attackers who managed to impersonate the feed server (via DNS poisoning, domain hijacking, ARP spoofing etc.), to provide a malicious response that injects parameters to curl command used by the affected RSS client class and effectively read/write arbitrary files on the vulnerable Nagios server. This could lead to Remote Code Execution in the context of www-data/nagios user on default Nagios installs that follow the official setup guidelines. This issue is due to incomplete fix of CVE-2008-4796. External References: https://legalhackers.com/advisories/Nagios-Exploit-Command-Injection-CVE-2016-9565-2008-4796.html
Created nagios tracking bugs for this issue: Affects: fedora-all [bug 1405364] Affects: epel-all [bug 1405365]
I looked at this in relation to Nagios 4.0.8 and found that Snoopy's fetch funtion is used by rss_fetch in Nagios. The 'rss_fetch' method in 'rss_fetch.inc' is called by various php files in Nagios, but doesn't except user input to the request. Setting RHMAP as wontfix as a consequence.
References: http://seclists.org/oss-sec/2016/q4/714
Mitigation: #!/bin/bash mv /usr/share/nagios/html/includes/rss /usr/share/nagios/html/includes/rss.disarmed mv /usr/share/nagios/html/rss-corefeed.php /usr/share/nagios/html/rss-corefeed.php.disarmed mv /usr/share/nagios/html/rss-newsfeed.php /usr/share/nagios/html/rss-newsfeed.php.disarmed This should disable rss from nagios installation and stop affected php code from being executed. Only downside to this would be news widget wont fetch any data from nagios.org rss feeds.
Nagios is shipped with Red Hat Gluster Storage 3.1, Red Hat Openstack 5,6,7, and Red Hat Mobile Application Platform 4. We are currently investigating for solutions. In the mean time please apply mitigation as mentioned in https://bugzilla.redhat.com/show_bug.cgi?id=1405363#c6 which will disable affected PHP code from execution.
This issue is actually in Snoopy - a PHP class for fetching web pages: https://sourceforge.net/projects/snoopy/ Snoopy is embedded in MagpieRSS, which is embedded in nagios. The issue was fixed in Snoopy upstream by changing it to use native PHP functions to fetch web pages instead of using curl: http://snoopy.cvs.sourceforge.net/viewvc/snoopy/Snoopy/Snoopy.class.php?view=log#rev1.29 Nagios upstream fixed the problem in version 4.2.2 by removing MagpieRSS and hence Snoopy: https://github.com/NagiosEnterprises/nagioscore/commit/f0808f9c2aca777685ba57e71a8cd7b4baa8aa78 Note that this CVE is actually a dupe of CVE-2014-5008 (bug 1121497).
Current status: This package does not have an active maintainer. I am working on an updated replacement package which fixes these problems but need some reviews and help to make it work on Fedora 24/25 and help with selinux policy to get it ready to put into the 'stream'. The updated replacement package is at: https://copr.fedorainfracloud.org/coprs/smooge/Nagios_Update/ I do not know if this fixes the security bug so I need help here also.
Stephen, your copr package should fix the vulnerability as they should be all fixed as of Nagios 4.2.4.
This issue has been addressed in the following products: Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7 Via RHSA-2017:0214 https://rhn.redhat.com/errata/RHSA-2017-0214.html
This issue has been addressed in the following products: Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7 Via RHSA-2017:0213 https://rhn.redhat.com/errata/RHSA-2017-0213.html
This issue has been addressed in the following products: Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6 Via RHSA-2017:0212 https://rhn.redhat.com/errata/RHSA-2017-0212.html
This issue has been addressed in the following products: Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7 Via RHSA-2017:0211 https://rhn.redhat.com/errata/RHSA-2017-0211.html
This issue has been addressed in the following products: Red Hat Gluster Storage 3.1 for RHEL 6 Via RHSA-2017:0259 https://rhn.redhat.com/errata/RHSA-2017-0259.html
This issue has been addressed in the following products: Red Hat Gluster Storage 3.1 for RHEL 7 Via RHSA-2017:0258 https://rhn.redhat.com/errata/RHSA-2017-0258.html