Nagios: Buffer overflow

Nagios: Buffer overflow Nagios is vulnerable to a buffer overflow which may lead to remote execution of arbitrary code. nagios May 07, 2006 May 25, 2006: 03 132159 133487 remote 1.4.1 1.4.1

Nagios is an open source host, service and network monitoring program.

Sebastian Krahmer of the SuSE security team discovered a buffer overflow vulnerability in the handling of a negative HTTP Content-Length header.

A buffer overflow in Nagios CGI scripts under certain web servers allows remote attackers to execute arbitrary code via a negative content length HTTP header.

There is no known workaround at this time.

All Nagios users should upgrade to the latest version:


    # emerge --sync
    # emerge --ask --oneshot --verbose ">=net-analyzer/nagios-core-1.4.1"

CVE-2006-2162 CVE-2006-2489 koon fox2mike jaervosz