CVE-2016-2057
First published: Wed Apr 13 2016(Updated: )
lib/xymond_ipc.c in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 use weak permissions (666) for an unspecified IPC message queue, which allows local users to inject arbitrary messages by writing to that queue.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Xymon | =4.1.0 | |
| Xymon | =4.1.1 | |
| Xymon | =4.1.2 | |
| Xymon | =4.1.2-p1 | |
| Xymon | =4.1.2-p2 | |
| Xymon | =4.2-alfa | |
| Xymon | =4.2-beta20060605 | |
| Xymon | =4.2-rc20060712 | |
| Xymon | =4.2.0 | |
| Xymon | =4.2.2 | |
| Xymon | =4.2.2-rc1 | |
| Xymon | =4.2.3 | |
| Xymon | =4.2.3-rc1 | |
| Xymon | =4.3.0 | |
| Xymon | =4.3.0-beta1 | |
| Xymon | =4.3.0-beta2 | |
| Xymon | =4.3.0-beta3 | |
| Xymon | =4.3.0-rc1 | |
| Xymon | =4.3.1 | |
| Xymon | =4.3.2 | |
| Xymon | =4.3.3 | |
| Xymon | =4.3.4 | |
| Xymon | =4.3.5 | |
| Xymon | =4.3.6 | |
| Xymon | =4.3.7 | |
| Xymon | =4.3.8 | |
| Xymon | =4.3.9 | |
| Xymon | =4.3.10 | |
| Xymon | =4.3.11 | |
| Xymon | =4.3.12 | |
| Xymon | =4.3.13 | |
| Xymon | =4.3.14 | |
| Xymon | =4.3.15 | |
| Xymon | =4.3.16 | |
| Xymon | =4.3.17 | |
| Xymon | =4.3.18 | |
| Xymon | =4.3.19 | |
| Xymon | =4.3.19-rc1 | |
| Xymon | =4.3.20 | |
| Xymon | =4.3.21 | |
| Xymon | =4.3.22 | |
| Xymon | =4.3.23 | |
| Xymon | =4.3.24 | |
| Debian | =8.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2016-2057?
CVE-2016-2057 is classified as a medium severity vulnerability due to weak permissions allowing local users to inject arbitrary messages.
How do I fix CVE-2016-2057?
Fix CVE-2016-2057 by updating Xymon to version 4.3.25 or later to ensure proper permissions are set on the IPC message queue.
What versions of Xymon are affected by CVE-2016-2057?
CVE-2016-2057 affects Xymon versions 4.1.x, 4.2.x, and 4.3.x before version 4.3.25.
Can CVE-2016-2057 be exploited remotely?
CVE-2016-2057 cannot be exploited remotely as it requires local access for users to inject messages.
What type of attack can CVE-2016-2057 facilitate?
CVE-2016-2057 can facilitate message injection attacks by allowing unauthorized local users to interfere with IPC message queues.
- agent/references
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/author
- agent/weakness
- agent/remedy
- agent/last-modified-date
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/xymon
- canonical/xymon
- version/xymon/4.1.0
- version/xymon/4.1.1
- version/xymon/4.1.2
- version/xymon/4.1.2-p1
- version/xymon/4.1.2-p2
- version/xymon/4.2-alfa
- version/xymon/4.2-beta20060605
- version/xymon/4.2-rc20060712
- version/xymon/4.2.0
- version/xymon/4.2.2
- version/xymon/4.2.2-rc1
- version/xymon/4.2.3
- version/xymon/4.2.3-rc1
- version/xymon/4.3.0
- version/xymon/4.3.0-beta1
- version/xymon/4.3.0-beta2
- version/xymon/4.3.0-beta3
- version/xymon/4.3.0-rc1
- version/xymon/4.3.1
- version/xymon/4.3.2
- version/xymon/4.3.3
- version/xymon/4.3.4
- version/xymon/4.3.5
- version/xymon/4.3.6
- version/xymon/4.3.7
- version/xymon/4.3.8
- version/xymon/4.3.9
- version/xymon/4.3.10
- version/xymon/4.3.11
- version/xymon/4.3.12
- version/xymon/4.3.13
- version/xymon/4.3.14
- version/xymon/4.3.15
- version/xymon/4.3.16
- version/xymon/4.3.17
- version/xymon/4.3.18
- version/xymon/4.3.19
- version/xymon/4.3.19-rc1
- version/xymon/4.3.20
- version/xymon/4.3.21
- version/xymon/4.3.22
- version/xymon/4.3.23
- version/xymon/4.3.24
- vendor/debian
- canonical/debian
- version/debian/8.0