IBM Support

Security Bulletin: Vulnerabilities in nagios affect PowerKVM

Security Bulletin


Summary

PowerKVM is affected by numerous vulnerabilities in nagios. These vulnerabilities are now fixed.

Vulnerability Details

CVEID: CVE-2014-5008
DESCRIPTION:
Snoopy could allow a remote attacker to execute arbitrary commands on the system, caused by an incomplete fix related to the use of escapeshellcmd where escapeshellarg was required. An attacker could exploit this vulnerability to execute arbitrary commands on the system.
CVSS Base Score: 7.5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/116470 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P)

CVEID: CVE-2014-1878
DESCRIPTION:
Icinga is vulnerable to a stack-based buffer overflow, caused by improper bounds checking by the cmd_submitf() function. By sending an overly long string argument, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash.
CVSS Base Score: 7.5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/91206 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P)

CVEID: CVE-2014-5009
DESCRIPTION:
Snoopy could allow a remote attacker to execute arbitrary commands on the system, caused by an incomplete fix related to the exec() function. An attacker could exploit this vulnerability to execute arbitrary commands on the system.
CVSS Base Score: 6.8
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/94738 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:P/A:P)

CVEID: CVE-2008-4796
DESCRIPTION:
Snoopy could allow a remote attacker to execute arbitrary commands on the system, caused by improper validation of user-supplied input by the Snoopy.class.php script. An attacker could exploit this vulnerability using a specially-crafted request to execute arbitrary commands with privileges of the application.
CVSS Base Score: 7.5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/46068 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P)

CVEID: CVE-2008-7313
DESCRIPTION:
Snoopy could allow a remote attacker to execute arbitrary commands on the system, caused by an incomplete fix related to the _httpsrequest() function. An attacker could exploit this vulnerability to execute arbitrary commands on the system.
CVSS Base Score: 6.8
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/94737 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:P/A:P)

CVEID: CVE-2013-4214
DESCRIPTION:
Nagios could allow a local attacker to launch a symlink attack. The html/rss-newsfeed.php script creates temporary files insecurely. A local attacker could exploit this vulnerability by creating a symbolic link from a temporary file to various files on the system, which could allow the attacker to overwrite arbitrary files on the system with elevated privileges.
CVSS Base Score: 3.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/86320 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:L/AC:M/Au:N/C:N/I:P/A:P)

CVEID: CVE-2013-7108
DESCRIPTION:
Icinga is vulnerable to an off-by-one buffer overflow, caused by improper validation of user supplied input by process_cgivars() method. A remote attacker could overflow a buffer and execute arbitrary code on the system or cause the application.
CVSS Base Score: 4.9
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/89801 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:S/C:P/I:N/A:P)

CVEID: CVE-2013-7205
DESCRIPTION:
Nagios is vulnerable to a denial of service, caused by an off-by-one error in the process_cgivars() function. By sending a specially-crafted key value, an attacker could exploit this vulnerability to trigger an out-of-bounds read error.
CVSS Base Score: 5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/89945 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P)

Affected Products and Versions

PowerKVM 2.1 and PowerKVM 3.1

Remediation/Fixes

Customers can update PowerKVM systems by using "yum update".

Fix images are made available via Fix Central. For version 3.1, see https://ibm.biz/BdHggw for 3.1.0.2 update 2 or later.

For version 2.1, see PowerKVM 2.1.1.3-65. Update 12 at https://ibm.biz/BdEnT8 or later. Customers running v2.1 are, in any case, encouraged to upgrade to v3.1.

For v2.1 systems currently running fix levels of PowerKVM prior to 2.1.1, please see http://download4.boulder.ibm.com/sar/CMA/OSA/05e4c/0/README for prerequisite fixes and instructions.

Workarounds and Mitigations

None

Get Notified about Future Security Bulletins

References

Complete CVSS v2 Guide
On-line Calculator v2

Related information

Change History

6 Sep 2016 - Initial Version

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

Disclaimer

According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.

Document information

More support for: PowerKVM

Software version: 2.1, 3.1

Operating system(s): Linux

Software edition: KVM

Reference #: T1024264

Modified date: 05 October 2016