CNVD-2016-12677

Vulnerability from cnvd - Published: 2016-12-21
VLAI
Title
Nagios Core远程命令注入漏洞
Description
Nagios是美国程序员Ethan Galstad所研发的一套开源的系统运行状态和网络信息监控程序。该程序提供网络服务监控、主机资源监控、短信报警等功能。 Nagios Core存在远程命令注入漏洞。允许攻击者利用漏洞在受影响的应用程序的上下文中使用用户权限执行任意命令。
Severity
高
Patch Name
Nagios Core远程命令注入漏洞的补丁
Patch Description
Nagios是美国程序员Ethan Galstad所研发的一套开源的系统运行状态和网络信息监控程序。该程序提供网络服务监控、主机资源监控、短信报警等功能。 Nagios Core存在远程命令注入漏洞。允许攻击者利用漏洞在受影响的应用程序的上下文中使用用户权限执行任意命令。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。
Formal description

用户可参考如下供应商提供的安全公告获得补丁信息： https://legalhackers.com/advisories/Nagios-Exploit-Command-Injection-CVE-2016-9565-2008-4796.html

Reference
http://www.securityfocus.com/bid/94922
Impacted products
Name
Nagios Nagios < 4.2.2
Show details on source website
To clipboard 

{
  "bids": {
    "bid": {
      "bidNumber": "94922"
    }
  },
  "cves": {
    "cve": {
      "cveNumber": "CVE-2016-9565"
    }
  },
  "description": "Nagios\u662f\u7f8e\u56fd\u7a0b\u5e8f\u5458Ethan Galstad\u6240\u7814\u53d1\u7684\u4e00\u5957\u5f00\u6e90\u7684\u7cfb\u7edf\u8fd0\u884c\u72b6\u6001\u548c\u7f51\u7edc\u4fe1\u606f\u76d1\u63a7\u7a0b\u5e8f\u3002\u8be5\u7a0b\u5e8f\u63d0\u4f9b\u7f51\u7edc\u670d\u52a1\u76d1\u63a7\u3001\u4e3b\u673a\u8d44\u6e90\u76d1\u63a7\u3001\u77ed\u4fe1\u62a5\u8b66\u7b49\u529f\u80fd\u3002\r\n\r\nNagios Core\u5b58\u5728\u8fdc\u7a0b\u547d\u4ee4\u6ce8\u5165\u6f0f\u6d1e\u3002\u5141\u8bb8\u653b\u51fb\u8005\u5229\u7528\u6f0f\u6d1e\u5728\u53d7\u5f71\u54cd\u7684\u5e94\u7528\u7a0b\u5e8f\u7684\u4e0a\u4e0b\u6587\u4e2d\u4f7f\u7528\u7528\u6237\u6743\u9650\u6267\u884c\u4efb\u610f\u547d\u4ee4\u3002",
  "discovererName": "Dawid Golunski of legalhackers",
  "formalWay": "\u7528\u6237\u53ef\u53c2\u8003\u5982\u4e0b\u4f9b\u5e94\u5546\u63d0\u4f9b\u7684\u5b89\u5168\u516c\u544a\u83b7\u5f97\u8865\u4e01\u4fe1\u606f\uff1a\r\nhttps://legalhackers.com/advisories/Nagios-Exploit-Command-Injection-CVE-2016-9565-2008-4796.html",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2016-12677",
  "openTime": "2016-12-21",
  "patchDescription": "Nagios\u662f\u7f8e\u56fd\u7a0b\u5e8f\u5458Ethan Galstad\u6240\u7814\u53d1\u7684\u4e00\u5957\u5f00\u6e90\u7684\u7cfb\u7edf\u8fd0\u884c\u72b6\u6001\u548c\u7f51\u7edc\u4fe1\u606f\u76d1\u63a7\u7a0b\u5e8f\u3002\u8be5\u7a0b\u5e8f\u63d0\u4f9b\u7f51\u7edc\u670d\u52a1\u76d1\u63a7\u3001\u4e3b\u673a\u8d44\u6e90\u76d1\u63a7\u3001\u77ed\u4fe1\u62a5\u8b66\u7b49\u529f\u80fd\u3002\r\n\r\nNagios Core\u5b58\u5728\u8fdc\u7a0b\u547d\u4ee4\u6ce8\u5165\u6f0f\u6d1e\u3002\u5141\u8bb8\u653b\u51fb\u8005\u5229\u7528\u6f0f\u6d1e\u5728\u53d7\u5f71\u54cd\u7684\u5e94\u7528\u7a0b\u5e8f\u7684\u4e0a\u4e0b\u6587\u4e2d\u4f7f\u7528\u7528\u6237\u6743\u9650\u6267\u884c\u4efb\u610f\u547d\u4ee4\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Nagios Core\u8fdc\u7a0b\u547d\u4ee4\u6ce8\u5165\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "Nagios     Nagios \u003c 4.2.2"
  },
  "referenceLink": "http://www.securityfocus.com/bid/94922",
  "serverity": "\u9ad8",
  "submitTime": "2016-12-16",
  "title": "Nagios Core\u8fdc\u7a0b\u547d\u4ee4\u6ce8\u5165\u6f0f\u6d1e"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.