[ MDVSA-2009:054 ] nagios (fwd)

Gadi Evron ge at linuxbox.org
Wed Feb 25 14:35:14 CST 2009


---------- Forwarded message ----------
Date: Wed, 25 Feb 2009 01:05:01 +0100
From: security at mandriva.com
Reply-To: xsecurity at mandriva.com
To: bugtraq at securityfocus.com
Subject: [ MDVSA-2009:054 ] nagios


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

  _______________________________________________________________________

  Mandriva Linux Security Advisory                         MDVSA-2009:054
  http://www.mandriva.com/security/
  _______________________________________________________________________

  Package : nagios
  Date    : February 24, 2009
  Affected: Corporate 4.0
  _______________________________________________________________________

  Problem Description:

  A vulnerability has been identified and corrected in nagios:

  Cross-site scripting (XSS) vulnerability in Nagios allows remote
  attackers to inject arbitrary web script or HTML via unknown vectors,
  a different vulnerability than CVE-2007-5624 and CVE-2008-1360
  (CVE-2007-5803).

  The updated packages have been upgraded to the latest version of
  nagios to prevent this.
  _______________________________________________________________________

  References:

  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5803
  _______________________________________________________________________

  Updated Packages:

  Corporate 4.0:
  2f4eff0f154fb6b5470d1cb0fad177be  corporate/4.0/i586/nagios-3.1.0-0.1.20060mlcs4.i586.rpm
  97dd676d23af47a198b4d7d8a4a98772  corporate/4.0/i586/nagios-devel-3.1.0-0.1.20060mlcs4.i586.rpm
  19658855978419d653aa3ad103d4a202  corporate/4.0/i586/nagios-theme-default-3.1.0-0.1.20060mlcs4.i586.rpm
  a6f6d5a202d2261977fc45fb5f0cf239  corporate/4.0/i586/nagios-www-3.1.0-0.1.20060mlcs4.i586.rpm
  810578c6a17cd25e2c4b5c08f5363111  corporate/4.0/SRPMS/nagios-3.1.0-0.1.20060mlcs4.src.rpm

  Corporate 4.0/X86_64:
  fcca43b9dfedae723b76beee215b4ae4  corporate/4.0/x86_64/nagios-3.1.0-0.1.20060mlcs4.x86_64.rpm
  f6051010aa536ff0943693e29a86dfea  corporate/4.0/x86_64/nagios-devel-3.1.0-0.1.20060mlcs4.x86_64.rpm
  485776dee99e096ce00e34a90f9b4af5  corporate/4.0/x86_64/nagios-theme-default-3.1.0-0.1.20060mlcs4.x86_64.rpm
  3eecf54904721ef8ce9fb3c75a40be66  corporate/4.0/x86_64/nagios-www-3.1.0-0.1.20060mlcs4.x86_64.rpm
  810578c6a17cd25e2c4b5c08f5363111  corporate/4.0/SRPMS/nagios-3.1.0-0.1.20060mlcs4.src.rpm
  _______________________________________________________________________

  To upgrade automatically use MandrivaUpdate or urpmi.  The verification
  of md5 checksums and GPG signatures is performed automatically for you.

  All packages are signed by Mandriva for security.  You can obtain the
  GPG public key of the Mandriva Security Team by executing:

   gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

  You can view other update advisories for Mandriva Linux at:

   http://www.mandriva.com/security/advisories

  If you want to report vulnerabilities, please contact

   security_(at)_mandriva.com
  _______________________________________________________________________

  Type Bits/KeyID     Date       User ID
  pub  1024D/22458A98 2000-07-10 Mandriva Security Team
   <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFJpGCOmqjQ0CJFipgRAu5OAJ9wt+wnm65Wvz1Nq7lumj/V6yvHVwCeO+6U
efZ1ppeQ7XVjLx+IIeP8XjQ=
=Vi1C
-----END PGP SIGNATURE-----




More information about the NANOG mailing list