[ GLSA 200605-07 ] Nagios: Buffer overflow

[GLSA]

Gentoo Linux Security Advisory

Title: Nagios: Buffer overflow (GLSA 200605-07)
Severity: high
Exploitable: remote
Date: May 07, 2006
Updated: May 25, 2006
Bug(s): #132159, #133487
ID: 200605-07

Synopsis


Nagios is vulnerable to a buffer overflow which may lead to remote
execution of arbitrary code.


Background


Nagios is an open source host, service and network monitoring program.


Affected Packages

Package: net-analyzer/nagios-core
Vulnerable: < 1.4.1
Unaffected: >= 1.4.1
Architectures: All supported architectures


Description


Sebastian Krahmer of the SuSE security team discovered a buffer
overflow vulnerability in the handling of a negative HTTP
Content-Length header.


Impact


A buffer overflow in Nagios CGI scripts under certain web servers
allows remote attackers to execute arbitrary code via a negative
content length HTTP header.


Workaround


There is no known workaround at this time.


Resolution


All Nagios users should upgrade to the latest version: