CVE-2016-9565: Command Injection
MagpieRSS, a component for handling RSS news feeds in Nagios Core control panel / front-end, was found vulnerable to command injection due to insufficient neutralization of special elements in function httpsrequest().
The vulnerability could potentially enable remote unauthenticated attackers who managed to impersonate the feed server (via DNS poisoning, domain hijacking, ARP spoofing etc.), to provide a malicious response that injects parameters to curl command used by the affected RSS client class and effectively read/write arbitrary files on the vulnerable Nagios server. This could lead to Remote Code Execution in the context of www-data/nagios user on default Nagios installs that follow the official setup guidelines.
This issue is due to incomplete fix of CVE-2008-4796.
External References:
https://legalhackers.com/advisories/Nagios-Exploit-Command-Injection-CVE-2016-9565-2008-4796.html
Other sources
MagpieRSS, as used in the front-end component in Nagios Core before 4.2.2 might allow remote attackers to read or write to arbitrary files by spoofing a crafted response from the Nagios RSS feed server. NOTE: this vulnerability exists because of an incomplete fix for CVE-2008-4796.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-9565?
CVE-2016-9565 is considered a medium severity vulnerability due to its potential for file read or write access by remote attackers.
How do I fix CVE-2016-9565?
To mitigate CVE-2016-9565, upgrade Nagios Core to version 4.2.2 or later.
What impacts does CVE-2016-9565 have on Nagios Core?
CVE-2016-9565 could allow remote attackers to read or manipulate arbitrary files through a crafted RSS feed response.
Which versions of Nagios are affected by CVE-2016-9565?
CVE-2016-9565 affects Nagios Core versions prior to 4.2.2, including versions up to 4.2.1.
Why does CVE-2016-9565 exist?
CVE-2016-9565 exists due to an incomplete fix for the earlier vulnerability CVE-2008-4796.