CVE-2014-1878: Buffer Overflow
A potential buffer overflow vulnerability was reported in Icinga [1],[2] which could possibly be exploited by remote attackers to cause a denial of service. This vulnerability is caused due to a boundary error in the cmdsubmitf() function. This code in Icinga originated in Nagios, and a visual inspection of the code indicates Nagios is likewise affected.
CVE-2014-1878 was assigned to Icinga, however given that the code is identical and has the same origin (Nagios is the originator) the same CVE should also apply to Nagios.
This is fixed in Icinga git [3].
[1] https://www.icinga.org/2014/02/11/bugfix-releases-1-10-3-1-9-5-1-8-6/ [2] https://dev.icinga.org/issues/5434 [3] https://dev.icinga.org/projects/icinga-core/repository/revisions/eedf4f7d88cdc50843572224eb38a2f5c78a2dc5
Other sources
Stack-based buffer overflow in the cmdsubmitf function in cgi/cmd.c in Nagios Core, possibly 4.0.3rc1 and earlier, and Icinga before 1.8.6, 1.9 before 1.9.5, and 1.10 before 1.10.3 allows remote attackers to cause a denial of service (segmentation fault) via a long message to cmd.cgi.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
nagios/nagios-coreto a version that resolves this vulnerability.Fixed in 4.0.3rc1 - Upgrade
Upgrade
icinga/icinga-coreto a version that resolves this vulnerability.Fixed in 1.8.6 - Upgrade
Upgrade
icinga/icinga-coreto a version that resolves this vulnerability.Fixed in 1.9.5 - Upgrade
Upgrade
icinga/icinga-coreto a version that resolves this vulnerability.Fixed in 1.10.3
Event History
Frequently Asked Questions
What is the severity of CVE-2014-1878?
CVE-2014-1878 has a severity rating that indicates it could potentially allow remote denial of service attacks.
How do I fix CVE-2014-1878?
To fix CVE-2014-1878, update Icinga to version 1.10.2 or later and Nagios to version 4.0.3 or higher.
What versions of Icinga are affected by CVE-2014-1878?
CVE-2014-1878 affects Icinga versions from 1.8.0 to 1.10.1.
Can CVE-2014-1878 be exploited remotely?
Yes, CVE-2014-1878 can be exploited by remote attackers to cause a denial of service.
Is Nagios affected by CVE-2014-1878?
Yes, CVE-2014-1878 also affects certain versions of Nagios, specifically 4.0.0 to 4.0.2.