diff options
Diffstat (limited to 'metadata/glsa/glsa-200403-14.xml')
| -rw-r--r-- | metadata/glsa/glsa-200403-14.xml | 73 |
1 files changed, 73 insertions, 0 deletions
diff --git a/metadata/glsa/glsa-200403-14.xml b/metadata/glsa/glsa-200403-14.xml new file mode 100644 index 000000000000..0d910a46fad6 --- /dev/null +++ b/metadata/glsa/glsa-200403-14.xml @@ -0,0 +1,73 @@ +<?xml version="1.0" encoding="utf-8"?> +<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd"> + +<glsa id="200403-14"> + <title>Multiple Security Vulnerabilities in Monit</title> + <synopsis> + A denial of service and a buffer overflow vulnerability have been found in + Monit. + </synopsis> + <product type="ebuild">app-admin/monit</product> + <announced>March 31, 2004</announced> + <revised>May 22, 2006: 02</revised> + <bug>43967</bug> + <access>remote</access> + <affected> + <package name="app-admin/monit" auto="yes" arch="*"> + <unaffected range="ge">4.2</unaffected> + <vulnerable range="le">4.1</vulnerable> + </package> + </affected> + <background> + <p> + Monit is a system administration utility that allows management and + monitoring of processes, files, directories and devices on a Unix + system. + </p> + </background> + <description> + <p> + A denial of service may occur due to Monit not sanitizing remotely + supplied HTTP parameters before passing them to memory allocation + functions. This could allow an attacker to cause an unexpected + condition that could lead to the Monit daemon crashing. + </p> + <p> + An overly long http request method may cause a buffer overflow due to + Monit performing insufficient bounds checking when handling HTTP + requests. + </p> + </description> + <impact type="high"> + <p> + An attacker may crash the Monit daemon to create a denial of service + condition or cause a buffer overflow that would allow arbitrary code to + be executed with root privileges. + </p> + </impact> + <workaround> + <p> + A workaround is not currently known for this issue. All users are + advised to upgrade to the latest version of the affected package. + </p> + </workaround> + <resolution> + <p> + Monit users should upgrade to version 4.2 or later: + </p> + <code> + # emerge sync + + # emerge -pv ">=app-admin/monit-4.2" + # emerge ">=app-admin/monit-4.2"</code> + </resolution> + <references> + <uri link="http://www.securityfocus.com/bid/9098">Monit HTTP Content-Length Parameter Denial of Service Vulnerability</uri> + <uri link="http://www.securityfocus.com/bid/9099">Monit Overly Long HTTP Request Buffer Overrun Vulnerability</uri> + <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-1083">CVE-2003-1083</uri> + <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-1084">CVE-2003-1084</uri> + </references> + <metadata tag="submitter" timestamp="Mon, 22 May 2006 05:44:45 +0000"> + DerCorny + </metadata> +</glsa> |