Bugzilla – Bug 885207
VUL-1: CVE-2014-4702: nagios-plugins: check_icmp Arbitrary Option File Read
Last modified: 2016-09-08 22:20:09 UTC
Similar to the CVE-2014-4701 issue in the check_dhcp plug-in, the same flaw was found to affect check_icmp. A local attacker could obtain sensitive information by using this flaw to read parts of INI configuration files that belong to the root user. As stated on nagios-plugins-README.SuSE-check_icmp, SUSE doesn't set the setuid bit as default. Therefore we aren't affected. References: http://seclists.org/oss-sec/2014/q2/709 https://bugzilla.redhat.com/show_bug.cgi?id=1114841
Well, to be honest: if you want to run this check in production, your have to run the check via setuid root (or use sudo, which is also recommended in the README). We already ship apparmor profiles for * check_dhcp * check_ntp_time But - for compatibly reasons - we do not enable them on SLE, just on openSUSE. I like to suppose (especially as Upstream has not yet provided a final fix) to switch to an enforce mode for those two checks and also add the apparmor profiles for check_icmp here, to cover all setuid root checks. BUT: if we enable the apparmor profiles, customers have to add their configuration files to the profiles (and we should really inform the users about this change). But this should help with this bug. What do you think: * wait for an upstream fix (a complete one - or take the current one?) * enable apparmor for those profiles?
@Martin: as I'm on vacation, can you please take a look?
We have to wait for an upstream fix since we can't assume everyone runs apparmor in enforcing mode or at all.
HI Johannes, I investigate it with fallowing results : The fix for the vulnerability with SUID binaries (check_icmp, check_dhcp) has been fix in nagios-plugins the the upstream version 2.0.2. Now nagios-plugins has new version 2.0.3 I also spoke about it with community behind Monitoring Plugins project (https://www.monitoring-plugins.org ) about the vulnerability. The version 2.0 (latest stable) should be not effected. My question is where is fix should be done ? are we talking about OpenSUSE build repository server:monitoring ? are we talking about update for SLE-11-SP3 or for OpenSUSE ? Martin
In my view it's sufficient to just fix it in its development project since we're not shipping it setuid and it's a minor issue.
Hi, we are shipping it without setuid, but as Lars already said, in the comment #c1, to actually run it, you should run it either with setuid or sudo. So as discussed now with Marcus, this should be fixed on SLE-11-SP3 and OpenSUSE. Is that possible to backport the patch?
Affected packages: SLE-11-SP3: nagios-plugins SLE-11-SP3-PRODUCTS: nagios-plugins SLE-11-SP3-UPTU: nagios-plugins
An update workflow for this issue was started. This issue was rated as low. Please submit fixed packages until 2014-10-30. When done, reassign the bug to security-team@suse.de. https://swamp.suse.de/webswamp/wf/59247
(In reply to Lars Vogdt from comment #1) > I like to suppose (especially as Upstream has not yet provided a final fix) > to switch to an enforce mode for those two checks and also add the apparmor > profiles for check_icmp here, to cover all setuid root checks. > > BUT: if we enable the apparmor profiles, customers have to add their > configuration files to the profiles (and we should really inform the users > about this change). But this should help with this bug. Samba uses a script to auto-generate an AppArmor profile sniplet based on the configuration (it allows access to all configured shares). Would something like that also make sense for nagios?
SUSE-SU-2014:1352-1: An update that fixes two vulnerabilities is now available. Category: security (low) Bug References: 885205,885207 CVE References: CVE-2014-4701,CVE-2014-4702 Sources used: SUSE Linux Enterprise Server 11 SP3 for VMware (src): nagios-plugins-1.4.16-0.13.1 SUSE Linux Enterprise Server 11 SP3 (src): nagios-plugins-1.4.16-0.13.1
An update for nagios-plugins-1.4.16-0.13.1 that fixes two vulnerabilities was publish see: CVE References: CVE-2014-4701,CVE-2014-4702 Bug References: 885205,885207