Test ID:	1.3.6.1.4.1.25623.1.0.106473
Category:	Web application abuses
Title:	Nagios RCE Vulnerability
Summary:	Nagios is prone to a remote command execution (RCE); vulnerability.
Description:	Summary: Nagios is prone to a remote command execution (RCE) vulnerability. Vulnerability Insight: The vulnerability is caused by the use of a vulnerable component for handling RSS news feeds - MagpieRSS in Nagios Core control panel/front-end. The component is used by Nagios front-end to load news feeds from remote feed source upon log-in. The component was found vulnerable to CVE-2008-4796 which fix was incomplete. Vulnerability Impact: An attacker who manages to impersonate the feed source, may be able to inject malicious parameters to curl command and effectively read/write arbitrary files on the target Nagios server which finally may lead to arbitrary code execution. Affected Software/OS: Nagios before version 4.2.2. Solution: Update to version 4.2.2 or later. CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2016-9565 BugTraq ID: 94922 http://www.securityfocus.com/bid/94922 Bugtraq: 20161215 Nagios Core < 4.2.2 Curl Command Injection leading to Remote Code Execution [CVE-2016-9565] (Google Search) http://www.securityfocus.com/archive/1/539925/100/0/threaded https://www.exploit-db.com/exploits/40920/ http://seclists.org/fulldisclosure/2016/Dec/57 https://security.gentoo.org/glsa/201702-26 https://security.gentoo.org/glsa/201710-20 http://packetstormsecurity.com/files/140169/Nagios-Core-Curl-Command-Injection-Code-Execution.html https://legalhackers.com/advisories/Nagios-Exploit-Command-Injection-CVE-2016-9565-2008-4796.html RedHat Security Advisories: RHSA-2017:0211 http://rhn.redhat.com/errata/RHSA-2017-0211.html RedHat Security Advisories: RHSA-2017:0212 http://rhn.redhat.com/errata/RHSA-2017-0212.html RedHat Security Advisories: RHSA-2017:0213 http://rhn.redhat.com/errata/RHSA-2017-0213.html RedHat Security Advisories: RHSA-2017:0214 http://rhn.redhat.com/errata/RHSA-2017-0214.html RedHat Security Advisories: RHSA-2017:0258 http://rhn.redhat.com/errata/RHSA-2017-0258.html RedHat Security Advisories: RHSA-2017:0259 http://rhn.redhat.com/errata/RHSA-2017-0259.html http://www.securitytracker.com/id/1037488
Copyright	Copyright (C) 2016 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.