Icinga Director is a tool designed to make Icinga 2 configuration handling easy. Not any of Icinga Director's configuration forms used to manipulate the monitoring environment are protected against cross site request forgery (CSRF). It enables attackers to perform changes in the monitoring environment managed by Icinga Director without the awareness of the victim. Users of the map module in version 1.x, should immediately upgrade to v2.0. The mentioned XSS vulnerabilities in Icinga Web are already fixed as well and upgrades to the most recent release of the 2.9, 2.10 or 2.11 branch must be performed if not done yet. Any later major release is also suitable. Icinga Director will receive minor updates to the 1.8, 1.9, 1.10 and 1.11 branches to remedy this issue. Upgrade immediately to a patched release. If that is not feasible, disable the director module for the time being.

A potential buffer overflow vulnerability was reported in Icinga [1],[2] which could possibly be exploited by remote attackers to cause a denial of service. This vulnerability is caused due to a boundary error in the cmdsubmitf() function. This code in Icinga originated in Nagios, and a visual inspection of the code indicates Nagios is likewise affected.

CVE-2014-1878 was assigned to Icinga, however given that the code is identical and has the same origin (Nagios is the originator) the same CVE should also apply to Nagios.

This is fixed in Icinga git [3].

[1] https://www.icinga.org/2014/02/11/bugfix-releases-1-10-3-1-9-5-1-8-6/ [2] https://dev.icinga.org/issues/5434 [3] https://dev.icinga.org/projects/icinga-core/repository/revisions/eedf4f7d88cdc50843572224eb38a2f5c78a2dc5

Multiple off-by-one errors in Nagios Core 3.5.1, 4.0.2, and earlier, and Icinga before 1.8.5, 1.9 before 1.9.4, and 1.10 before 1.10.2 allow remote authenticated users to obtain sensitive information from process memory or cause a denial of service (crash) via a long string in the last key value in the variable list to the processcgivars function in (1) avail.c, (2) cmd.c, (3) config.c, (4) extinfo.c, (5) histogram.c, (6) notifications.c, (7) outages.c, (8) status.c, (9) statusmap.c, (10) summary.c, and (11) trends.c in cgi/, which triggers a heap-based buffer over-read.

Cross-site request forgery (CSRF) vulnerability in cmd.cgi in Icinga 1.8.5, 1.9.4, 1.10.2, and earlier allows remote attackers to hijack the authentication of users for unspecified commands via unspecified vectors, as demonstrated by bypassing authentication requirements for CVE-2013-7106.

Multiple stack-based buffer overflows in Icinga before 1.8.5, 1.9 before 1.9.4, and 1.10 before 1.10.2 allow remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via a long string to the (1) displaynavtable, (2) pagelimitselector, (3) printexportlink, or (4) pagenumselector function in cgi/cgiutils.c; (5) statuspagenumselector function in cgi/status.c; or (6) displaycommandexpansion function in cgi/config.c. NOTE: this can be exploited without authentication by leveraging CVE-2013-7107.