Bug 829217 (CVE-2013-4114) - VUL-0: CVE-2013-4114: nagstamon: Nagstamon (prior 0.9.10): Monitor server user credentials exposure in automated requests to get update information
Summary: VUL-0: CVE-2013-4114: nagstamon: Nagstamon (prior 0.9.10): Monitor server use...
Status: RESOLVED FIXED
Alias: CVE-2013-4114
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Lars Vogdt
QA Contact: Security Team bot
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2013-07-12 09:56 UTC by Marcus Meissner
Modified: 2015-02-18 23:50 UTC (History)
4 users (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Marcus Meissner 2013-07-12 09:56:34 UTC 
is public, via oss-sec

CVE-2013-4114

Hello Kurt, Steve, vendors,

  an user details information exposure flaw was found in the way Nagstamon,
Nagios status monitor for desktop, performed automated requests to get
information about available updates. Remote attacker could use this flaw
to obtain user credentials for server monitored by the desktop status
monitor due to their improper (base64 encoding based) encoding in the
HTTP request, when the HTTP Basic authentication scheme was used.

References:
[1] http://nagstamon.ifw-dresden.de/docs/security/
[2] https://bugs.gentoo.org/show_bug.cgi?id=476538
[3] https://bugzilla.redhat.com/show_bug.cgi?id=983673

Can you allocate a CVE id for this?

Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Response Team
Comment 1 Swamp Workflow Management 2013-07-12 22:00:26 UTC 
bugbot adjusting priority
Comment 2 Lars Vogdt 2013-07-13 12:05:50 UTC 
I like to update to the latest version 0.9.10 to fix the issue without starting to patch the old version. 

The new one is compatible to the currently released one but fixes also smaller memory leaks and other small bugs. The new features added in the new version do not harm or change the behavior known by the old version.

I uploaded the newest version in server:monitoring already. This would also be my favorite for the maintenance update.
Comment 3 Marcus Meissner 2013-07-17 09:41:48 UTC 
sounds good.
Comment 4 Sebastian Krahmer 2013-07-23 13:56:21 UTC 
released
Comment 5 Swamp Workflow Management 2013-07-23 14:04:23 UTC 
openSUSE-SU-2013:1235-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 829217
CVE References: CVE-2013-4114
Sources used:
openSUSE 12.3 (src):    nagstamon-0.9.10-4.4.1
openSUSE 12.2 (src):    nagstamon-0.9.10-2.4.1