<html> <head> <meta content="text/html; charset=ISO-8859-1" http-equiv="Content-Type"> </head> <body text="#000000" bgcolor="#FFFFFF"> <div class="moz-cite-prefix">Fixed in the Nagios 3.4.4 release candidate, as well as in the Core 4 trunk. Announced last week: <blockquote type="cite"> <pre wrap="">All, I have uploaded a release candidate tarball for Nagios Core 3.4.4 to SourceForge. If you are so inclined, please download a copy from <a class="moz-txt-link-freetext" href="https://sourceforge.net/projects/nagios/files/nagios-3.x/nagios-3.4.4/">https://sourceforge.net/projects/nagios/files/nagios-3.x/nagios-3.4.4/</a> and give it a test run. Any feedback would be appreciated. I plan to create the release mid-week next week. The change log is as follows: * Fixed bug #408: service checks get duplicated on reload (Eric Stanley) * Fixed bug #401: segmentation fault on Solaris when parsing unknown timeperiod directives. (Eric Stanley) * Added NULL pointer checks to CGI code. (Eric Stanley) * Fixed buffer overflow vulnerability in CGI code. Thanks to Neohapsis (<a class="moz-txt-link-freetext" href="http://archives.neohapsis.com/archives/fulldisclosure/2012-12/0108.html">http://archives.neohapsis.com/archives/fulldisclosure/2012-12/0108.html</a>) for finding this. (Eric Stanley) Thanks, Eric</pre> </blockquote> On 1/11/2013 11:58 AM, Leonardo - Mandic wrote: </div> <blockquote cite="mid:50F052BC.2010605@mandic.com.br" type="cite"> <meta content="text/html; charset=ISO-8859-1" http-equiv="Content-Type"> Hello, Anybody have more informations about this exploit of Nagios? <meta http-equiv="content-type" content="text/html; charset=ISO-8859-1"> <a moz-do-not-send="true" href="http://pastebin.com/FJUNyTaj">http://pastebin.com/FJUNyTaj</a> Leonardo <fieldset class="mimeAttachmentHeader"></fieldset> <pre wrap="">------------------------------------------------------------------------------ Master HTML5, CSS3, ASP.NET, MVC, AJAX, Knockout.js, Web API and much more. Get web development skills now with LearnDevNow - 350+ hours of step-by-step video tutorials by Microsoft MVPs and experts. SALE $99.99 this month only -- learn more at: <a class="moz-txt-link-freetext" href="http://p.sf.net/sfu/learnmore_122812">http://p.sf.net/sfu/learnmore_122812</a></pre> <fieldset class="mimeAttachmentHeader"></fieldset> <pre wrap="">_______________________________________________ Nagios-users mailing list <a class="moz-txt-link-abbreviated" href="mailto:Nagios-users@lists.sourceforge.net">Nagios-users@lists.sourceforge.net</a> <a class="moz-txt-link-freetext" href="https://lists.sourceforge.net/lists/listinfo/nagios-users">https://lists.sourceforge.net/lists/listinfo/nagios-users</a> ::: Please include Nagios version, plugin version (-v) and OS when reporting any issue. ::: Messages without supporting info will risk being sent to /dev/null</pre> </blockquote> <pre class="moz-signature" cols="72">-- Mike Guthrie Technical Team ___ Nagios Enterprises, LLC Email: <a class="moz-txt-link-abbreviated" href="mailto:mguthrie@nagios.com">mguthrie@nagios.com</a> Web: <a class="moz-txt-link-abbreviated" href="http://www.nagios.com">www.nagios.com</a> </pre> </body> </html>