USN-282-1: Nagios vulnerability

Releases

• Ubuntu 5.10
• Ubuntu 5.04

Details

The nagios CGI scripts did not sufficiently check the validity of the
HTTP Content-Length attribute. By sending a specially crafted HTTP
request with a negative Content-Length value to the Nagios server, a
remote attacker could exploit this to execute arbitrary code with web
server privileges.

Please note that the Apache 2 web server already checks for valid
Content-Length values, so installations using Apache 2 (the only web
server officially supported in Ubuntu) are not vulnerable to this
flaw.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 5.10

• nagios-common -

Ubuntu 5.04

• nagios-common -

In general, a standard system update will make all the necessary changes.

References

• CVE-2006-2162