CVE-2013-7108
Quick assessment
Affected
n/a n/a
Exploitation
High exploitation probability; assess promptly
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Nagios是美国程序员Ethan Galstad所研发的一套开源的系统运行状态和网络信息监控程序，该程序提供网络服务监控、主机资源监控、短信报警等功能。Icinga是Icinga项目的一套企业级开源监控系统，是一个介于Nagios社区版和企业版间的产品。 Nagios Core和Icinga中的cgi/目录下的(1)avail.c,(2)cmd.c,(3)config.c,(4)extinfo.c,(5)histogram.c,(6)notifications.c,(7)outages.c,(8)sta
Public Exploits 1
ExploitDB · 1
EDB-38882 [dos]
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2013-7108
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
Multiple off-by-one errors in Nagios Core 3.5.1, 4.0.2, and earlier, and Icinga before 1.8.5, 1.9 before 1.9.4, and 1.10 before 1.10.2 allow remote authenticated users to obtain sensitive information from process memory or cause a denial of service (crash) via a long string in the last key value in the variable list to the process_cgivars function in (1) avail.c, (2) cmd.c, (3) config.c, (4) extinfo.c, (5) histogram.c, (6) notifications.c, (7) outages.c, (8) status.c, (9) statusmap.c, (10) summary.c, and (11) trends.c in cgi/, which triggers a heap-based buffer over-read.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Icinga/Icinga ‘process_cgivars’函数输入验证漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Nagios是美国程序员Ethan Galstad所研发的一套开源的系统运行状态和网络信息监控程序，该程序提供网络服务监控、主机资源监控、短信报警等功能。Icinga是Icinga项目的一套企业级开源监控系统，是一个介于Nagios社区版和企业版间的产品。 Nagios Core和Icinga中的cgi/目录下的(1)avail.c,(2)cmd.c,(3)config.c,(4)extinfo.c,(5)histogram.c,(6)notifications.c,(7)outages.c,(8)sta
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | n/a | n/a | - |
|
II. Public POCs for CVE-2013-7108
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2013-7108
请登录查看更多情报信息。
Vendor Advisories for CVE-2013-7108 (4)
-
-
-
-
http://www.mandriva.com/security/advisories?name=MDVSA-2014:004 vendor-advisory x_refsource_MANDRIVA
Mailing List Discussions for CVE-2013-7108 (6)
Other References for CVE-2013-7108 (3)
-
https://dev.icinga.org/issues/5251 x_refsource_CONFIRM
-
https://www.icinga.org/2013/12/17/icinga-security-releases-1-10-2-1-9-4-1-8-5/ x_refsource_CONFIRM
Same Patch Batch · n/a · 2014-01-14 · 12 CVEs total
| CVE-2013-6398 | Apache CloudStack 权限许可和访问控制漏洞 | |
| CVE-2013-7106 | Icinga Web Interface 缓冲区溢出漏洞 | |
| CVE-2013-7107 | Icinga 跨站请求伪造漏洞 | |
| CVE-2013-7205 | Nagios‘process_cgivars()’函数差一错误拒绝服务漏洞 | |
| CVE-2014-0031 | Apache CloudStack 权限许可和访问控制漏洞 | |
| CVE-2014-0613 | Juniper Junos XNM命令处理器拒绝服务漏洞 | |
| CVE-2014-0615 | Juniper Junos 提权漏洞 | |
| CVE-2014-0616 | Juniper Junos 竞争条件漏洞 | |
| CVE-2014-0617 | Juniper Junos 安全漏洞 | |
| CVE-2013-6123 | Android for MSM摄像头驱动数组索引错误漏洞 | |
| CVE-2014-0591 | ISC BIND ‘query_findclosestnsec3’函数缓冲区溢出漏洞 |
IV. Related Vulnerabilities
V. Comments for CVE-2013-7108
No comments yet