News
Vigil@nce - Nagios Plugins: information disclosure via check_icmp
June 2014 by Vigil@nce
This bulletin was written by Vigil@nce : http://vigilance.fr/offer
SYNTHESIS OF THE VULNERABILITY
An attacker can use check_icmp of Nagios Plugins, to read a file
with INI format, in order to obtain sensitive information.
Impacted products: Nagios Open Source
Severity: 2/4
Creation date: 21/05/2014
DESCRIPTION OF THE VULNERABILITY
The check_icmp script of Nagios Plugins is installed suid root:
The "—extra-opts" option is used to read a file in format INI :
[section]
var=val
However, check_icmp reads these files with root privileges.
An attacker can therefore use check_icmp of Nagios Plugins, to
read a file with INI format, in order to obtain sensitive
information.
ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN
http://vigilance.fr/vulnerability/Nagios-Plugins-information-disclosure-via-check-icmp-14776
