CVE-2013-7205: Buffer Overflow
First published: Wed Jan 15 2014(Updated: )
Off-by-one error in the process_cgivars function in contrib/daemonchk.c in Nagios Core 3.5.1, 4.0.2, and earlier allows remote authenticated users to obtain sensitive information from process memory or cause a denial of service (crash) via a long string in the last key value in the variable list, which triggers a heap-based buffer over-read.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Nagios | <=4.0.2 | |
| Nagios | =3.0 | |
| Nagios | =3.0-alpha1 | |
| Nagios | =3.0-alpha2 | |
| Nagios | =3.0-alpha3 | |
| Nagios | =3.0-alpha4 | |
| Nagios | =3.0-alpha5 | |
| Nagios | =3.0-beta1 | |
| Nagios | =3.0-beta2 | |
| Nagios | =3.0-beta3 | |
| Nagios | =3.0-beta4 | |
| Nagios | =3.0-beta5 | |
| Nagios | =3.0-beta6 | |
| Nagios | =3.0-beta7 | |
| Nagios | =3.0-rc1 | |
| Nagios | =3.0-rc2 | |
| Nagios | =3.0-rc3 | |
| Nagios | =3.0.1 | |
| Nagios | =3.0.2 | |
| Nagios | =3.0.3 | |
| Nagios | =3.0.4 | |
| Nagios | =3.0.5 | |
| Nagios | =3.0.6 | |
| Nagios | =3.1.0 | |
| Nagios | =3.1.1 | |
| Nagios | =3.1.2 | |
| Nagios | =3.2.0 | |
| Nagios | =3.2.1 | |
| Nagios | =3.2.2 | |
| Nagios | =3.2.3 | |
| Nagios | =3.3.1 | |
| Nagios | =3.4.0 | |
| Nagios | =3.4.1 | |
| Nagios | =3.4.2 | |
| Nagios | =3.4.3 | |
| Nagios | =3.5.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://secunia.com/advisories/55976
- http://sourceforge.net/p/nagios/nagioscore/ci/d97e03f32741a7d851826b03ed73ff4c9612a866/
- http://www.mandriva.com/security/advisories?name=MDVSA-2014:004
- http://www.openwall.com/lists/oss-security/2013/12/24/1
- http://www.securityfocus.com/bid/64489
- https://lists.debian.org/debian-lts-announce/2018/12/msg00014.html
Frequently Asked Questions
What is the severity of CVE-2013-7205?
CVE-2013-7205 is considered to have a medium severity rating due to its potential for denial of service and information disclosure.
How do I fix CVE-2013-7205?
To fix CVE-2013-7205, upgrade Nagios to a version later than 4.0.2 or apply the appropriate patches provided by the Nagios development team.
Who is affected by CVE-2013-7205?
CVE-2013-7205 affects Nagios Core versions 3.5.1, 4.0.2, and earlier releases.
What type of vulnerability is CVE-2013-7205?
CVE-2013-7205 is identified as an off-by-one error vulnerability, which can lead to memory corruption.
Can CVE-2013-7205 lead to a denial of service attack?
Yes, CVE-2013-7205 can lead to a denial of service by crashing the Nagios service through a crafted input.
- agent/references
- agent/weakness
- agent/author
- agent/type
- agent/event
- agent/softwarecombine
- agent/last-modified-date
- agent/first-publish-date
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/severity
- agent/description
- vendor/nagios
- canonical/nagios
- version/nagios/4.0.2
- version/nagios/3.0
- version/nagios/3.0-alpha1
- version/nagios/3.0-alpha2
- version/nagios/3.0-alpha3
- version/nagios/3.0-alpha4
- version/nagios/3.0-alpha5
- version/nagios/3.0-beta1
- version/nagios/3.0-beta2
- version/nagios/3.0-beta3
- version/nagios/3.0-beta4
- version/nagios/3.0-beta5
- version/nagios/3.0-beta6
- version/nagios/3.0-beta7
- version/nagios/3.0-rc1
- version/nagios/3.0-rc2
- version/nagios/3.0-rc3
- version/nagios/3.0.1
- version/nagios/3.0.2
- version/nagios/3.0.3
- version/nagios/3.0.4
- version/nagios/3.0.5
- version/nagios/3.0.6
- version/nagios/3.1.0
- version/nagios/3.1.1
- version/nagios/3.1.2
- version/nagios/3.2.0
- version/nagios/3.2.1
- version/nagios/3.2.2
- version/nagios/3.2.3
- version/nagios/3.3.1
- version/nagios/3.4.0
- version/nagios/3.4.1
- version/nagios/3.4.2
- version/nagios/3.4.3
- version/nagios/3.5.1