CVE-2013-2131: Medium severity rrdtool vulnerability
Format string vulnerability in the rrdtool module 1.4.7 for Python, as used in Zenoss, allows context-dependent attackers to cause a denial of service (crash) via format string specifiers to the rrdtool.graph function.
Other sources
Thomas Pollet (thomas.pollet) reports:
Also, the rrdtool python module crashes on format string exploit $ python -c "import rrdtool rrdtool.graph('/tmp/out.png','-f','%n%n')" Segmentation fault
this module is used by zenoss to create graphs (zenoss users are able to pass arguments to rrdtool).
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-2131?
CVE-2013-2131 is classified as a moderate severity vulnerability due to its potential to cause denial of service.
How do I fix CVE-2013-2131?
To fix CVE-2013-2131, upgrade to a version of RRDtool that is newer than 1.4.7.
What software is affected by CVE-2013-2131?
CVE-2013-2131 affects the RRDtool version 1.4.7 module for Python.
What is the impact of CVE-2013-2131?
The impact of CVE-2013-2131 is the potential for contextual attackers to trigger a crash in applications using the vulnerable RRDtool module.
Who reported CVE-2013-2131?
CVE-2013-2131 was reported by Thomas Pollet.