CVE-2016-2056: Command Injection
Published Apr 13, 2016
·Updated
xymond in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 allow remote authenticated users to execute arbitrary commands via shell metacharacters in the addusername argument in (1) web/useradm.c or (2) web/chpasswd.c.
Affected Software
44 affected components
Xymon xymon=4.1.0
Xymon xymon=4.1.1
Xymon xymon=4.1.2
Xymon xymon=4.1.2-p1
Xymon xymon=4.1.2-p2
Xymon xymon=4.2-alfa
Xymon xymon=4.2-beta20060605
Xymon xymon=4.2-rc20060712
Xymon xymon=4.2.0
Xymon xymon=4.2.2
Xymon xymon=4.2.2-rc1
Xymon xymon=4.2.3
Xymon xymon=4.2.3-rc1
Xymon xymon=4.3.0
Xymon xymon=4.3.0-beta1
Xymon xymon=4.3.0-beta2
Xymon xymon=4.3.0-beta3
Xymon xymon=4.3.0-rc1
Xymon xymon=4.3.1
Xymon xymon=4.3.2
Xymon xymon=4.3.3
Xymon xymon=4.3.4
Xymon xymon=4.3.5
Xymon xymon=4.3.6
Xymon xymon=4.3.7
Xymon xymon=4.3.8
Xymon xymon=4.3.9
Xymon xymon=4.3.10
Xymon xymon=4.3.11
Xymon xymon=4.3.12
Xymon xymon=4.3.13
Xymon xymon=4.3.14
Xymon xymon=4.3.15
Xymon xymon=4.3.16
Xymon xymon=4.3.17
Xymon xymon=4.3.18
Xymon xymon=4.3.19
Xymon xymon=4.3.19-rc1
Xymon xymon=4.3.20
Xymon xymon=4.3.21
Xymon xymon=4.3.22
Xymon xymon=4.3.23
Xymon xymon=4.3.24
Debian Debian Linux=8.0
Remediation
Patch Available
Event History
Apr 13, 2016
CVE Published
via MITRE·04:00 PM
Data Sourced
via MITRE·04:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2016-2056?
The severity of CVE-2016-2056 is classified as high due to the ability for remote authenticated users to execute arbitrary commands.
2
How do I fix CVE-2016-2056?
To fix CVE-2016-2056, update Xymon to version 4.3.25 or later where the vulnerability has been patched.
3
Which versions of Xymon are affected by CVE-2016-2056?
CVE-2016-2056 affects Xymon versions 4.1.x, 4.2.x, and 4.3.x prior to 4.3.25.
4
Can CVE-2016-2056 be exploited without authentication?
No, CVE-2016-2056 requires remote authenticated access to exploit the vulnerability.
5
What is the mitigation for CVE-2016-2056 if I cannot update?
If you cannot update, consider disabling user administration features until the update can be applied.