REDHAT-BUG-957482: Medium severity nagios plugins vulnerability
Found during an audit of openstack and all its dependencies.
Error: nagios-plugins-1.4.16-6.el6ost/nagios-plugins-1.4.16/contrib/checkipxping.c
#define IPXPINGCOMMAND "/tmp/ipxping/ipxping"
The IPXPINGCOMMAND is used to build command line that is executed later on using execv. As this is a predictable location in a public area a local attacker may place their own file in that location or symlink to another command. AFAICT little or no checks are made about the file permissions or ownership.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-957482?
The severity of REDHAT-BUG-957482 is considered high due to potential command execution vulnerabilities.
How do I fix REDHAT-BUG-957482?
To fix REDHAT-BUG-957482, you should update the nagios-plugins package to the latest version that addresses this vulnerability.
Which versions of Nagios nagios-plugins are affected by REDHAT-BUG-957482?
REDHAT-BUG-957482 affects Nagios nagios-plugins version 1.4.16 and potentially other related versions that utilize the same command execution method.
What are the implications of not addressing REDHAT-BUG-957482?
Failing to address REDHAT-BUG-957482 could allow an attacker to execute arbitrary commands on the system through the ipxping command.
Is there a patch available for REDHAT-BUG-957482?
Yes, a patch addressing REDHAT-BUG-957482 is available and can be obtained by updating to the latest version of nagios-plugins.