CVE-2008-7313: Command Injection
CVE-2008-4796 describes a command execution flaw in the Snoopy library. A similar fix exists for headers:
http://snoopy.cvs.sourceforge.net/viewvc/snoopy/Snoopy/Snoopy.class.php?view=log#rev1.27
The header fix has been assigned CVE-2008-7313 (as an incomplete fix for CVE-2008-4796).
It was later reported that the CVE-2008-4796 fix was incomplete and command execution was still possible:
http://mstrokin.com/sec/feed2js-magpierss-0day-vulnerability-not-really-it-is-actually-cve-2005-3330-cve-2008-4796/
And fixed with the following:
http://snoopy.cvs.sourceforge.net/viewvc/snoopy/Snoopy/Snoopy.class.php?view=log#rev1.28
This has been assigned CVE-2014-5008 (as an incomplete fix for CVE-2008-4796).
However, the CVE-2014-5008 fix was also incomplete:
https://github.com/cogdog/feed2js/pull/12#issuecomment-48283706
This was fixed with the following:
http://snoopy.cvs.sourceforge.net/viewvc/snoopy/Snoopy/Snoopy.class.php?view=log#rev1.29
And assigned CVE-2014-5009 (as an incomplete fix for CVE-2014-5008).
References:
http://www.openwall.com/lists/oss-security/2014/07/09/11
Other sources
The httpsrequest function in Snoopy allows remote attackers to execute arbitrary commands. NOTE: this issue exists dues to an incomplete fix for CVE-2008-4796.
— Red Hat
Various command-execution flaws were found in the Snoopy library included with Nagios. These flaws allowed remote attackers to execute arbitrary commands by manipulating Nagios HTTP headers.
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2008-7313?
CVE-2008-7313 is considered a critical vulnerability due to its ability to allow remote attackers to execute arbitrary commands.
How do I fix CVE-2008-7313?
To fix CVE-2008-7313, upgrade the affected software packages, such as Nagios, to a version that includes the security patch for this vulnerability.
Which versions are affected by CVE-2008-7313?
CVE-2008-7313 affects specific versions of Nagios, particularly 0:3.5.1-9.el6 and 0:3.5.1-9.el7, as well as some versions of the Snoopy library.
What software is impacted by CVE-2008-7313?
CVE-2008-7313 impacts Nagios versions up to 4.2.3 and various versions of the Snoopy library.
Is there a known exploit for CVE-2008-7313?
Yes, CVE-2008-7313 can be exploited by remote attackers to execute arbitrary commands, highlighting its severity.