CVE-2013-7205

Name
CVE-2013-7205
Description
Off-by-one error in the process_cgivars function in contrib/daemonchk.c in Nagios Core 3.5.1, 4.0.2, and earlier allows remote authenticated users to obtain sensitive information from process memory or cause a denial of service (crash) via a long string in the last key value in the variable list, which triggers a heap-based buffer over-read.
NVD Severity
unknown
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
Vendor Advisory http://secunia.com/advisories/55976
CONFIRM http://sourceforge.net/p/nagios/nagioscore/ci/d97e03f32741a7d851826b03ed73ff4c9612a866/
MLIST http://www.openwall.com/lists/oss-security/2013/12/24/1
MANDRIVA http://www.mandriva.com/security/advisories?name=MDVSA-2014:004
BID http://www.securityfocus.com/bid/64489
MLIST https://lists.debian.org/debian-lts-announce/2018/12/msg00014.html

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:nagios:nagios:3.0:alpha2:*:*:*:*:*:* nagios == None == 3.0
cpe:2.3:a:nagios:nagios:3.0.3:*:*:*:*:*:*:* nagios == None == 3.0.3
cpe:2.3:a:nagios:nagios:3.0.4:*:*:*:*:*:*:* nagios == None == 3.0.4
cpe:2.3:a:nagios:nagios:3.2.2:*:*:*:*:*:*:* nagios == None == 3.2.2
cpe:2.3:a:nagios:nagios:3.2.3:*:*:*:*:*:*:* nagios == None == 3.2.3
cpe:2.3:a:nagios:nagios:3.0.5:*:*:*:*:*:*:* nagios == None == 3.0.5
cpe:2.3:a:nagios:nagios:3.0.6:*:*:*:*:*:*:* nagios == None == 3.0.6
cpe:2.3:a:nagios:nagios:3.3.1:*:*:*:*:*:*:* nagios == None == 3.3.1
cpe:2.3:a:nagios:nagios:3.4.0:*:*:*:*:*:*:* nagios == None == 3.4.0
cpe:2.3:a:nagios:nagios:*:*:*:*:*:*:*:* nagios >= None <= 4.0.2
cpe:2.3:a:nagios:nagios:3.0.1:*:*:*:*:*:*:* nagios == None == 3.0.1
cpe:2.3:a:nagios:nagios:3.0.2:*:*:*:*:*:*:* nagios == None == 3.0.2
cpe:2.3:a:nagios:nagios:3.2.0:*:*:*:*:*:*:* nagios == None == 3.2.0
cpe:2.3:a:nagios:nagios:3.2.1:*:*:*:*:*:*:* nagios == None == 3.2.1
cpe:2.3:a:nagios:nagios:3.4.3:*:*:*:*:*:*:* nagios == None == 3.4.3
cpe:2.3:a:nagios:nagios:3.5.1:*:*:*:*:*:*:* nagios == None == 3.5.1
cpe:2.3:a:nagios:nagios:3.1.0:*:*:*:*:*:*:* nagios == None == 3.1.0
cpe:2.3:a:nagios:nagios:3.1.1:*:*:*:*:*:*:* nagios == None == 3.1.1
cpe:2.3:a:nagios:nagios:3.1.2:*:*:*:*:*:*:* nagios == None == 3.1.2
cpe:2.3:a:nagios:nagios:3.4.1:*:*:*:*:*:*:* nagios == None == 3.4.1
cpe:2.3:a:nagios:nagios:3.4.2:*:*:*:*:*:*:* nagios == None == 3.4.2

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
nagios 3.12-main 3.5.1-r6 Carlo Landmeter <clandmeter@gmail.com> possibly vulnerable
nagios 3.11-main 3.5.1-r6 Carlo Landmeter <clandmeter@gmail.com> possibly vulnerable