CVE-2009-2288: OS Command Injection
Published Jul 1, 2009
·Updated
statuswml.cgi in Nagios before 3.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) ping or (2) Traceroute parameters.
Affected Software
32 affected components
Nagios nagios<=3.1.0
Nagios nagios=1.0
Nagios nagios=1.0b1
Nagios nagios=1.0b2
Nagios nagios=1.0b4
Nagios nagios=1.1
Nagios nagios=1.4.1
Nagios nagios=2.0
Nagios nagios=2.0b4
Nagios nagios=2.7
Nagios nagios=2.10
Nagios nagios=3.0
Nagios nagios=3.0-alpha1
Nagios nagios=3.0-alpha2
Nagios nagios=3.0-alpha3
Nagios nagios=3.0-alpha4
Nagios nagios=3.0-beta1
Nagios nagios=3.0-beta2
Nagios nagios=3.0-beta3
Nagios nagios=3.0-beta4
Nagios nagios=3.0-beta5
Nagios nagios=3.0-beta6
Nagios nagios=3.0-beta7
Nagios nagios=3.0-rc1
Nagios nagios=3.0-rc2
Nagios nagios=3.0-rc3
Nagios nagios=3.0.1
Nagios nagios=3.0.2
Nagios nagios=3.0.3
Nagios nagios=3.0.4
Nagios nagios=3.0.5
Nagios nagios=3.0.6
Event History
Jul 1, 2009
CVE Published
via MITRE·12:26 PM
Data Sourced
via MITRE·12:26 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2009-2288?
CVE-2009-2288 has a moderate severity rating, as it allows remote attackers to execute arbitrary commands.
2
How do I fix CVE-2009-2288?
To fix CVE-2009-2288, upgrade to Nagios version 3.1.1 or later, which resolves this vulnerability.
3
Which versions of Nagios are affected by CVE-2009-2288?
CVE-2009-2288 affects Nagios versions 1.0, 1.1, 2.0, 2.7, and all 3.0 versions up to 3.1.0.
4
What components of Nagios are impacted by CVE-2009-2288?
CVE-2009-2288 affects the statuswml.cgi component in Nagios.
5
Can CVE-2009-2288 be exploited remotely?
Yes, CVE-2009-2288 can be exploited remotely through crafted input in the ping or Traceroute parameters.