Buffer overflow in Icinga

CVE-2014-1878

Stack-based buffer overflow in the cmd_submitf function in cgi/cmd.c in Nagios Core, possibly 4.0.3rc1 and earlier, and Icinga before 1.8.6, 1.9 before 1.9.5, and 1.10 before 1.10.3 allows remote attackers to cause a denial of service (segmentation fault) via a long message to cmd.cgi.

Vulnerability class: Buffer Overflow

EPSS: 0.031 (86.5th percentile) — read the EPSS interpretation.

Affected products

Icinga — versions 1.8.0, 1.8.1, 1.8.2
Nagios — versions 4.0.0, 4.0.2
N/a — versions n/a

Weakness classification (CWE)

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer

References

cve@mitre.org (vendor-advisory, x_refsource_SUSE)
cve@mitre.org (x_refsource_CONFIRM, Patch)
cve@mitre.org (x_refsource_CONFIRM)
cve@mitre.org (x_refsource_CONFIRM)
cve@mitre.org (vdb-entry, x_refsource_BID)
cve@mitre.org (mailing-list, x_refsource_MLIST)
cve@mitre.org (x_refsource_SECUNIA, Vendor Advisory, third-party-advisory)