The _httpsrequest function in Snoopy allows remote attackers to execute arbitrary commands. NOTE: this issue exists dues to an incomplete fix for CVE-2008-4796.
MagpieRSS, as used in the front-end component in Nagios Core before 4.2.2 might allow remote attackers to read or write to arbitrary files by spoofing a crafted response from the Nagios RSS feed server. NOTE: this vulnerability exists because of an incomplete fix for CVE-2008-4796.
base/logging.c in Nagios Core before 4.2.4 allows local users with access to an account in the nagios group to gain root privileges via a symlink attack on the log file. NOTE: this can be leveraged by remote attackers using CVE-2016-9565.
Off-by-one error in the process_cgivars function in contrib/daemonchk.c in Nagios Core 3.5.1, 4.0.2, and earlier allows remote authenticated users to obtain sensitive information from process memory or cause a denial of service (crash) via a long string in the last key value in the variable list, which triggers a heap-based buffer over-read.
Nagios Core before 4.3.3 creates a nagios.lock PID file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for nagios.lock modification before a root script executes a "kill `cat /pathname/nagios.lock`" command.
rss-newsfeed.php in Nagios Core 3.4.4, 3.5.1, and earlier, when MAGPIE_CACHE_ON is set to 1, allows local users to overwrite arbitrary files via a symlink attack on /tmp/magpie_cache.
qh_help in Nagios Core version 4.4.1 and earlier is prone to a NULL pointer dereference vulnerability, which allows attacker to cause a local denial-of-service condition by sending a crafted payload to the listening UNIX socket.
Multiple off-by-one errors in Nagios Core 3.5.1, 4.0.2, and earlier, and Icinga before 1.8.5, 1.9 before 1.9.4, and 1.10 before 1.10.2 allow remote authenticated users to obtain sensitive information from process memory or cause a denial of service (crash) via a long string in the last key value in the variable list to the process_cgivars function in (1) av…
Stack-based buffer overflow in the cmd_submitf function in cgi/cmd.c in Nagios Core, possibly 4.0.3rc1 and earlier, and Icinga before 1.8.6, 1.9 before 1.9.5, and 1.10 before 1.10.3 allows remote attackers to cause a denial of service (segmentation fault) via a long message to cmd.cgi.
VuXML only (0) · listed, port not fixed yet
None. pkg audit reports nothing for this version.
Possibly backported (1) · The CVE record gives a range ending in a newer branch, check the branch changelog
This port tracks an older, still maintained branch. The CVE record only says “before X” with X in a newer branch, so it cannot tell whether this branch received the fix. This is an estimate, not a confirmation. These CVEs are not counted as unaddressed.
The _httpsrequest function (Snoopy/Snoopy.class.php) in Snoopy 1.2.3 and earlier, as used in (1) ampache, (2) libphp-snoopy, (3) mahara, (4) mediamate, (5) opendb, (6) pixelpost, and possibly other products, allows remote attackers to execute arbitrary commands via shell metacharacters in https URLs.
Fixed (7)
VuXML entries whose affected range this version has left, plus CVEs whose record still lists this version although VuXML considers them fixed (usually a backported fix).
Off-by-one error in the process_cgivars function in contrib/daemonchk.c in Nagios Core 3.5.1, 4.0.2, and earlier allows remote authenticated users to obtain sensitive information from process memory or cause a denial of service (crash) via a long string in the last key value in the variable list, which triggers a heap-based buffer over-read.
Multiple off-by-one errors in Nagios Core 3.5.1, 4.0.2, and earlier, and Icinga before 1.8.5, 1.9 before 1.9.4, and 1.10 before 1.10.2 allow remote authenticated users to obtain sensitive information from process memory or cause a denial of service (crash) via a long string in the last key value in the variable list to the process_cgivars function in (1) av…
In the rc.d scripts, change assignments to rcvar to use the literal name_enable wherever possible, and ${name}_enable when it's not, to prepare for the demise of set_rcvar().
In cases where I had to hand-edit unusual instances also
modify formatting slightly to be more uniform (and in
some cases, correct). This includes adding some $FreeBSD$
tags, and most importantly moving rcvar= to right after
name= so it's clear that one is derived from the other.
- Add LDFLAGS to CONFIGURE_ENV and MAKE_ENV (as it was done with LDFLAGS) - Fix all ports that add {CPP,LD}FLAGS to *_ENV to modify flags instead
PR: 157936
Submitted by: myself
Exp-runs by: pav
Approved by: pav
- update nagios-core to 3.2.3. This is a bugfix update only.
Changelog:
* Fixes problem where disabling all active hosts/services was not taking effect
* Fixes for compiler warnings (code cleanup by Stephen Gran)
* Fixes for format errors in event handler logging (Guillaume Rousse)
* Fixed incorrect info in sample nagios.cfg file for state_retention_file (Michael Friedrich)
* Fixed broker_event_handler() to return ERR if data is NULL (Michael Friedrich)
PR: 151661
Submitted by: Alexander Wittig <alexander _at_ wittig.name>
Approved by: maintainer, glarkin(mentor, implicit)
- The nagios documentation (http://nagios.sourceforge.net/docs/3_0/faststartup.html) recommends, for faster startup times, pre-caching the configuration file. This patch adds a "nagios_precache" rcvar which controls using the pre-cache startup method.
- also fix a trailing \
PR: ports/139848
Submitted by: kimo <kimor79@yahoo.com>
Approved by: maintainer (Jarrod Sayers <jarrod@netleader.com.au>)
-Repocopy devel/libtool15 -> libtool22 and libltdl15 -> libltdl22. -Update libtool and libltdl to 2.2.6a. -Remove devel/libtool15 and devel/libltdl15. -Fix ports build with libtool22/libltdl22. -Bump ports that depend on libltdl22 due to shared library version change. -Explain what to do update in the UPDATING.
It has been tested with GNOME2, XFCE4, KDE3, KDE4 and other many wm/desktop
and applications in the runtime.
With help: marcus and kwm
Pointyhat-exp: a few times by pav
Tested by: pgollucci, "Romain Tartière" <romain@blogreen.org>, and
a few MarcusCom CVS users. Also, I might have missed a few.
Repocopy by: marcus
Approved by: portmgr
Fix a few "bad example" problems in the rc.d scripts that have been propogated by copy and paste.
1. Primarily the "empty variable" default assignment, which is mostly
${name}_flags="", but fix a few others as well.
2. Where they are not already documented, add the existence of the _flags
(or other deleted empties) option to the comments, and in some cases add
comments from scratch.
3. Replace things that look like:
prefix=%%PREFIX%%
command=${prefix}/sbin/foo
to just use %%PREFIX%%. In many cases the $prefix variable is only used
once, and in some cases it is not used at all.
4. In a few cases remove ${name}_flags from command_args
5. Remove a long-stale comment about putting the port's rc.d script in
/etc/rc.d (which is no longer necessary).
No PORTREVISION bumps because all of these changes are noops.
- Fix runtime problem with embedded perl. - Mark as MAKE_JOBS_UNSAFE. - Stop using DISTVERSION and use PORTVERSION in net-mgmt/nagios.
PR: ports/134175
Submitted by: Jarrod Sayers <jarrod@netleader.com.au> (maintainer)
- Merge UNHANDLED_HACK option from net-mgmt/nagios-devel. This option is off by default so do not bump PORTREVISION.
PR: ports/132712
Submitted by: Jarrod Sayers <jarrod@netleader.com.au> (maintainer)
Update to Nagios 3.0.6.
- Fix for CGI submission of external commands (writing newlines and
submitting service comments)
- Fix for Apache group membership in RPM spec file
- Fix for improper notification propagation command processing
- Better out-of-disk-space error handling when writing retention and
status files
- Disabled adaptive check and eventhandler commands for security reasons
- Fix for reading output from system commands (event handlers, etc) that
have timed out
- Added wildcard host matching in CGIs
- Fixes for playing audio alerts in CGIs
- Fix for incorrect host status links in status CGI when viewing
hostgroup summary
- Added support for x509 cert authentication in the CGIs
PR: ports/129409
Submitted by: Jarrod Sayers <jarrod@netleader.com.au> (maintainer)
- Update to 3.0.4
Note:
Included are updated suggestions from ports/128226. The correction to the ping
command has been extended into the online documentation and the -U option
removed as it's not supported. Also, the default for time_change_threshold is
set to that in include/nagios.h.
PR: 128306
Submitted by: Jarrod Sayers <jarrod@netleader.com.au> (maintainer)
Bump portrevision due to upgrade of devel/gettext.
The affected ports are the ones with gettext as a run-dependency
according to ports/INDEX-7 (5007 of them) and the ones with USE_GETTEXT
in Makefile (29 of them).
PR: ports/124340
Submitted by: edwin@
Approved by: portmgr (pav)
Link with libthr when available. This should fix the CPU consumption problem.
PR: ports/120150 ports/119766
Submitted by: jarrod@netleader.com.au bernd.kuhlen@wetteronline.de
Approved by: maintainer (implicit) garga (mentor)
Welcome bsd.perl.mk. Add support for constructs such as USE_PERL5=5.8.0+. Drop support for antique perl.
Work done by: gabor
Sponsored by: Google Summer of Code 2007
Hat: portmgr
- Update to 2.9
Changelog:
- Fix for incorrect performance data file write/append mode options
- Fix for current status of hosts with no host check command defined
- SIGSEGV signals should now be logged again (broken in 2.8)
- Configure script fix for no mail program found/installed on system
- Configure script option bug fixes for cygwin and embedded perl
- Command definitions and host/service plugin perfdata with HTML should now be
escaped in CGIs
- Patch for incorrect time down percentage in availability CGI
- Updated init script to fix a race condition during restarts
PR: 111505
Submitted by: Jarrod Sayers <jarrod@netleader.com.au> (maintainer)
Update to Nagios 2.8: - Bug fix for calculating notification interval with service escalations - Bug fix for using servicegroups in service dependency definitions - Bug fix for bad date format submission in command CGI - Possible segfault fix during restarts when daemon was performing host checks - Fix for missing check timeout in event broker calls - Fix for handling signals under NPTL - Added er
PR: 110262
Submitted by: Jarrod Sayers <jarrod@netleader.com.au> (maintainer)