Bug 845536 (CVE-2013-4214) - VUL-0: CVE-2013-4215 CVE-2013-4214 : nagios/nagios-plugins: temp file problem in check_ipxping and in rss-newsfeed.php
Summary: VUL-0: CVE-2013-4215 CVE-2013-4214 : nagios/nagios-plugins: temp file problem...
Status: RESOLVED INVALID
Alias: CVE-2013-4214
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P5 - None : Normal
Target Milestone: ---
Assignee: Lars Vogdt
QA Contact: Security Team bot
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2013-10-11 14:29 UTC by Marcus Meissner
Modified: 2013-10-14 20:36 UTC (History)
2 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Marcus Meissner 2013-10-11 14:29:19 UTC 
via oss-sec

CVE-2013-4214
CVE-2013-4215

References:
https://bugzilla.redhat.com/show_bug.cgi?id=958002
https://bugzilla.redhat.com/show_bug.cgi?id=957482
http://comments.gmane.org/gmane.comp.security.oss.general/10818

Some Nagios /tmp vulns (no reply from upstream)


No reply from upstream, these are both non critical so making public.
Does anyone know the best way to contact Nagios upstream for security
issues?

Nagios:
https://bugzilla.redhat.com/show_bug.cgi?id=958002
http://tracker.nagios.org/view.php?id=450
Please use CVE-2013-4214 for this issue.

Nagios-plugins:
https://bugzilla.redhat.com/show_bug.cgi?id=957482
http://tracker.nagios.org/view.php?id=451
Please use CVE-2013-4215 for this issue.

Both reported by Grant Murhphy (gmurphy@...) of Red Hat.
Comment 1 Marcus Meissner 2013-10-11 14:30:57 UTC 
i checked SLE11 , nagios and nagios-plugins seem unaffected by these two issues.


so it is just opensuse to fix, if at all.
Comment 2 Lars Vogdt 2013-10-14 20:36:17 UTC 
Neither check_ipxping nor rss-newsfeed.php are part of our nagios-plugins packages. So closing here as invalid. 

Thanks for keeping an eye on it!