Mageia alert MGASA-2016-0177 (xymon)

From:
    	     
 
Mageia Updates <buildsystem-daemon@mageia.org> 
To:
    	     
 
updates-announce@ml.mageia.org 
Subject:
    	     
 
[updates-announce] MGASA-2016-0177: Updated xymon packages fix security vulnerabilities 
Date:
    	     
 
Wed, 18 May 2016 22:14:52 +0200
Message-ID:
    	     
 
<20160518201452.D6B1D9F729@duvel.mageia.org>
MGASA-2016-0177 - Updated xymon packages fix security vulnerabilities

Publication date: 18 May 2016
URL: http://advisories.mageia.org/MGASA-2016-0177.html
Type: security
Affected Mageia releases: 5
CVE: CVE-2016-2054,
     CVE-2016-2055,
     CVE-2016-2056,
     CVE-2016-2057,
     CVE-2016-2058

Description:
Updated xymon packages fix security vulnerabilities:


The incorrect handling of user-supplied input in the "config" command can
trigger a stack-based buffer overflow, resulting in denial of service (via
application crash) or remote code execution (CVE-2016-2054).

The incorrect handling of user-supplied input in the "config" command can
lead to an information leak by serving sensitive configuration files to a
remote user (CVE-2016-2055).

The commands handling password management do not properly validate
user-supplied input, and are thus vulnerable to shell command injection by a
remote user (CVE-2016-2056).

Incorrect permissions on an internal queuing system allow a user with a local
account on the xymon master server to bypass all network-based access control
lists, and thus inject messages directly into xymon (CVE-2016-2057).

Incorrect escaping of user-supplied input in status webpages can be used to
trigger reflected cross-site scripting attacks (CVE-2016-2058).

Note that to effectively fix CVE-2016-2055, the /etc/xymon/xymonpasswd
configuration file should be owned by user and group apache with 640
permissions.

References:
- https://bugs.mageia.org/show_bug.cgi?id=17846
- https://www.debian.org/security/2016/dsa-3495
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2054
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2055
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2056
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2057
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2058

SRPMS:
- 5/core/xymon-4.3.17-5.1.mga5