rpms/nagios/EL-5 nagios-statuswml-remote-code.patch, NONE, 1.1 nagios.spec, 1.37, 1.38
Mike McGrath
mmcgrath at fedoraproject.org
Tue Jul 7 13:46:57 UTC 2009
Author: mmcgrath
Update of /cvs/pkgs/rpms/nagios/EL-5
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv15477
Modified Files:
nagios.spec
Added Files:
nagios-statuswml-remote-code.patch
Log Message:
fix for CVS-2009-2288
nagios-statuswml-remote-code.patch:
--- NEW FILE nagios-statuswml-remote-code.patch ---
--- cgi/statuswml.c 2008/11/30 18:13:11 1.27
+++ cgi/statuswml.c 2009/06/19 04:30:26 1.28
@@ -67,6 +67,8 @@
void document_header(void);
void document_footer(void);
int process_cgivars(void);
+int validate_arguments(void);
+int is_valid_hostip(char *hostip);
int display_type=DISPLAY_INDEX;
int hostgroup_style=DISPLAY_HOSTGROUP_SUMMARY;
@@ -108,6 +110,13 @@
document_header();
+ /* validate arguments in URL */
+ result=validate_arguments();
+ if(result==ERROR){
+ document_footer();
+ return ERROR;
+ }
+
/* read the CGI configuration file */
result=read_cgi_config_file(get_cgi_config_location());
if(result==ERROR){
@@ -334,7 +343,25 @@
return error;
}
+int validate_arguments(void){
+ int result=OK;
+ if((strcmp(ping_address,"")) && !is_valid_hostip(ping_address)) {
+ printf("<p>Invalid host name/ip</p>\n");
+ result=ERROR;
+ }
+ if(strcmp(traceroute_address,"") && !is_valid_hostip(traceroute_address)){
+ printf("<p>Invalid host name/ip</p>\n");
+ result=ERROR;
+ }
+ return result;
+ }
+int is_valid_hostip(char *hostip) {
+ char *valid_domain_chars="abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-";
+ if(strcmp(hostip,"") && strlen(hostip)==strspn(hostip,valid_domain_chars) && hostip[0] != '-' && hostip[strlen(hostip)-1] != '-')
+ return TRUE;
+ return FALSE;
+ }
/* main intro screen */
void display_index(void){
Index: nagios.spec
===================================================================
RCS file: /cvs/pkgs/rpms/nagios/EL-5/nagios.spec,v
retrieving revision 1.37
retrieving revision 1.38
diff -u -p -r1.37 -r1.38
--- nagios.spec 3 Mar 2009 14:54:51 -0000 1.37
+++ nagios.spec 7 Jul 2009 13:46:57 -0000 1.38
@@ -2,7 +2,7 @@
Name: nagios
Version: 2.12
-Release: 5%{?dist}
+Release: 6%{?dist}
Summary: Host/service/network monitoring program
Group: Applications/System
@@ -13,6 +13,7 @@ Source1: nagios.logrotate
Source2: nagios.htaccess
Patch0: nagios-initrd.patch
Patch1: output_buffer.patch
+Patch2: nagios-statuswml-remote-code.patch
BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
BuildRequires: gd-devel > 1.8, mailx, libjpeg-devel, libpng-devel
@@ -63,6 +64,7 @@ may compile against.
%setup -q
%patch0 -p0
%patch1 -p1
+%patch2 -p0
%build
./configure \
@@ -171,6 +173,9 @@ fi
%{_includedir}/%{name}
%changelog
+* Tue Jul 4 2009 Mike McGrath <mmcgrath at redhat.com> 2.12-6
+- Fix for CVE-2009-2288
+
* Tue Mar 3 2009 Mike McGrath <mmcgrath at redhat.com> 2.12-5
- Fix for bug 469198, increased plugin output buffer
More information about the fedora-extras-commits
mailing list