Ubuntu Security Notice USN-698-3 December 23, 2008========================================================== nagios2 vulnerabilities CVE-2008-5027, CVE-2008-5028 ========================================================== A security issue affects the following Ubuntu releases:
Ubuntu 8.04 LTS
This advisory also applies to the corresponding versions of Kubuntu, Edubuntu, and Xubuntu.
The problem can be corrected by upgrading your system to the following package versions:
Ubuntu 8.04 LTS: nagios2 2.11-1ubuntu1.4
After a standard system upgrade you need to restart Nagios to effect the necessary changes.
Details follow:
It was discovered that Nagios was vulnerable to a Cross-site request forger= y (CSRF) vulnerability. If an authenticated nagios user were tricked into clicking a link on a specially crafted web page, an attacker could trigger commands to be processed by Nagios and execute arbitrary programs. This update alters Nagios behaviour by disabling submission of CMD_CHANGE comman= ds. (CVE-2008-5028)
It was discovered that Nagios did not properly parse commands submitted usi= ng the web interface. An authenticated user could use a custom form or a brows= er addon to bypass security restrictions and submit unauthorized commands. (CVE-2008-5027)