CVE-2007-5198

Publication date 4 October 2007

Last updated 24 July 2024

Ubuntu priority

Medium

Why this priority?

Buffer overflow in the redir function in check_http.c in Nagios Plugins before 1.4.10, when running with the -f (follow) option, allows remote web servers to execute arbitrary code via Location header responses (redirects) with a large number of leading “L” characters.

Read the notes from the security team

Status

No maintained releases are affected by this CVE.

Package Ubuntu Release Status
nagios-plugins 7.10 gutsy
Fixed 1.4.8-2.1ubuntu1.1
7.04 feisty
Fixed 1.4.5-2ubuntu0.1
6.10 edgy
Fixed 1.4.3.0cvs.20060707-3ubuntu0.1
6.06 LTS dapper
Fixed 1.4.2-5ubuntu3.1

Notes

jdstrand

supplied debdiff in LP doesn’t address (fixed in CVS before 1.4.11) http://sourceforge.net/tracker/index.php?func=detail&aid=1813346&group_id=29880&atid=397597 also has two DoS: http://sourceforge.net/tracker/index.php?func=detail&aid=1729692&group_id=29880&atid=397597 http://nagiosplug.cvs.sourceforge.net/nagiosplug/nagiosplug/plugins/sslutils.c?r1=1.3&r2=1.4 (no bug report, see the changelog)

References

Related Ubuntu Security Notices (USN)

    • USN-532-1
    • nagios-plugins vulnerability
    • 22 October 2007

Other references