Buffer overflow in Icinga

CVE-2014-1878

Stack-based buffer overflow in the cmd_submitf function in cgi/cmd.c in Nagios Core, possibly 4.0.3rc1 and earlier, and Icinga before 1.8.6, 1.9 before 1.9.5, and 1.10 before 1.10.3 allows remote attackers to cause a denial of service (segmentation fault) via a long message to cmd.cgi.

Vulnerability class: Buffer Overflow

Published · last modified .

CVSS v2 metric

CVSS v2 base score 5.0 (Medium). Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P. This CVE predates CVSS v3 and has no v3 score from NVD.

EPSS exploit prediction

EPSS: 0.032 (87.6th percentile), scored .

Low probability of exploitation in the next 30 days, but still tracked. 88th percentile — 87.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2014-1878: held from 0.031 to 0.032.

EPSS over last 30 days · oldest: 0.031 · newest: 0.032 · change: +0.001

Affected products

  • Icinga — versions 1.8.0, 1.8.1, 1.8.2
  • Nagios — versions 4.0.0, 4.0.2

Weakness classification (CWE)

References