CVE and update status of the FreeBSD ports tree4,826 unaddressed CVEs in 618 portsAll times are CET

Port details

net-mgmt/nagios3.5.1_12

Powerful network monitoring system

Maintainer
ports@FreeBSD.org
Packages
nagios 3.5.1_12, nagios-monplugins 3.5.1_12
Upstream
up to date
CPE
nagios:nagios from the port
WWW
https://www.nagios.org/
Links
cgit · VuXML

Unaddressed (11) · The CVE record lists this version as affected, no VuXML entry names the CVE

CVE-2008-73139.8published 2017-03-31

The _httpsrequest function in Snoopy allows remote attackers to execute arbitrary commands. NOTE: this issue exists dues to an incomplete fix for CVE-2008-4796.

CVE-2014-50099.8published 2017-03-31

Snoopy allows remote attackers to execute arbitrary commands. NOTE: this vulnerability exists due to an incomplete fix for CVE-2014-5008.

CVE-2016-95659.8published 2016-12-15

MagpieRSS, as used in the front-end component in Nagios Core before 4.2.2 might allow remote attackers to read or write to arbitrary files by spoofing a crafted response from the Nagios RSS feed server. NOTE: this vulnerability exists because of an incomplete fix for CVE-2008-4796.

CVE-2016-100897.8published 2017-02-15

Nagios 4.3.2 and earlier allows local users to gain root privileges via a hard link attack on the Nagios init script file, related to CVE-2016-8641.

CVE-2016-95667.8published 2016-12-15

base/logging.c in Nagios Core before 4.2.4 allows local users with access to an account in the nagios group to gain root privileges via a symlink attack on the log file. NOTE: this can be leveraged by remote attackers using CVE-2016-9565.

CVE-2013-72056.4published 2014-01-15

Off-by-one error in the process_cgivars function in contrib/daemonchk.c in Nagios Core 3.5.1, 4.0.2, and earlier allows remote authenticated users to obtain sensitive information from process memory or cause a denial of service (crash) via a long string in the last key value in the variable list, which triggers a heap-based buffer over-read.

CVE-2017-128476.3published 2017-08-23

Nagios Core before 4.3.3 creates a nagios.lock PID file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for nagios.lock modification before a root script executes a "kill `cat /pathname/nagios.lock`" command.

CVE-2013-42146.3published 2013-11-23

rss-newsfeed.php in Nagios Core 3.4.4, 3.5.1, and earlier, when MAGPIE_CACHE_ON is set to 1, allows local users to overwrite arbitrary files via a symlink attack on /tmp/magpie_cache.

CVE-2018-134415.5published 2018-07-12

qh_help in Nagios Core version 4.4.1 and earlier is prone to a NULL pointer dereference vulnerability, which allows attacker to cause a local denial-of-service condition by sending a crafted payload to the listening UNIX socket.

CVE-2013-71085.5published 2014-01-15

Multiple off-by-one errors in Nagios Core 3.5.1, 4.0.2, and earlier, and Icinga before 1.8.5, 1.9 before 1.9.4, and 1.10 before 1.10.2 allow remote authenticated users to obtain sensitive information from process memory or cause a denial of service (crash) via a long string in the last key value in the variable list to the process_cgivars function in (1) av…

CVE-2014-18785.0published 2014-02-28

Stack-based buffer overflow in the cmd_submitf function in cgi/cmd.c in Nagios Core, possibly 4.0.3rc1 and earlier, and Icinga before 1.8.6, 1.9 before 1.9.5, and 1.10 before 1.10.3 allows remote attackers to cause a denial of service (segmentation fault) via a long message to cmd.cgi.

VuXML only (0) · listed, port not fixed yet

None. pkg audit reports nothing for this version.

Possibly backported (1) · The CVE record gives a range ending in a newer branch, check the branch changelog

This port tracks an older, still maintained branch. The CVE record only says “before X” with X in a newer branch, so it cannot tell whether this branch received the fix. This is an estimate, not a confirmation. These CVEs are not counted as unaddressed.
CVE-2008-479610.0published 2008-10-30

The _httpsrequest function (Snoopy/Snoopy.class.php) in Snoopy 1.2.3 and earlier, as used in (1) ampache, (2) libphp-snoopy, (3) mahara, (4) mediamate, (5) opendb, (6) pixelpost, and possibly other products, allows remote attackers to execute arbitrary commands via shell metacharacters in https URLs.

Fixed (7)

VuXML entries whose affected range this version has left, plus CVEs whose record still lists this version although VuXML considers them fixed (usually a backported fix).
CVE-2013-72056.4published 2014-01-15VuXML entry

Off-by-one error in the process_cgivars function in contrib/daemonchk.c in Nagios Core 3.5.1, 4.0.2, and earlier allows remote authenticated users to obtain sensitive information from process memory or cause a denial of service (crash) via a long string in the last key value in the variable list, which triggers a heap-based buffer over-read.

CVE-2013-71085.5published 2014-01-15VuXML entry

Multiple off-by-one errors in Nagios Core 3.5.1, 4.0.2, and earlier, and Icinga before 1.8.5, 1.9 before 1.9.4, and 1.10 before 1.10.2 allow remote authenticated users to obtain sensitive information from process memory or cause a denial of service (crash) via a long string in the last key value in the variable list to the process_cgivars function in (1) av…

Commits (161)

Ruslan Makhmatkhanov (rm) · 3.4.3
- update to 3.4.3 [1] - convert to optionsng [2] - fix portlint warnings [2]

PR:		174762
Submitted by:	Jarrod Sayers <jarrod@downtools.com.au> (maintainer) [1]
Submitted by:   tota [2]
efb5fe9366
Andrej Zverev (az) · 3.4.1
- Set default perl version for ports which currently using   (5.x+ and x < 12) scheme.

Approved by: bapt@ (portmgr@)
10a2b4693f
Michael Scheidell (scheidell) · 3.4.1
- Update to Nagios 3.4.1.

PR:		ports/168197
Submitted by:	Jarrod Sayers <jarrod@downtools.com.au> (maintainer)
a184e8c330
Doug Barton (dougb) · 3.3.1
In the rc.d scripts, change assignments to rcvar to use the literal name_enable wherever possible, and ${name}_enable when it's not, to prepare for the demise of set_rcvar().

In cases where I had to hand-edit unusual instances also
modify formatting slightly to be more uniform (and in
some cases, correct). This includes adding some $FreeBSD$
tags, and most importantly moving rcvar= to right after
name= so it's clear that one is derived from the other.
83eb2c3700
Ryan Steinmetz (zi) · 3.3.1
- Add configtest command to rc script

PR:		ports/161111
Submitted by:	Emil Smolenski <am@raisa.eu.org>
Approved by:	Jarrod Sayers <jarrod@downtools.com.au> (maintainer)
09ac64bb47
Dmitry Marakasov (amdmi3) · 3.3.1
- Add LDFLAGS to CONFIGURE_ENV and MAKE_ENV (as it was done with LDFLAGS) - Fix all ports that add {CPP,LD}FLAGS to *_ENV to modify flags instead

PR:		157936
Submitted by:	myself
Exp-runs by:	pav
Approved by:	pav
6f6fbe4bdf
Ryan Steinmetz (zi) · 3.3.1
- Update to 3.3.1 [1] - Use USERS/GROUPS [1] - Fix whitespace in Makefile [1] - Add LICENSE [1] - Correct rc script issues [2]

PR:		ports/159304
Submitted by:	Ryan Steinmetz (zi@) [1], Doug Barton (dougb@) [2]
Approved by: 	wxs (mentor), maintainer
b32e5ed950
Ade Lovett (ade) · 3.2.3
Sync to new bsd.autotools.mk
4a8684e352
Olli Hauer (ohauer) · 3.2.3
- update nagios-core to 3.2.3. This is a bugfix update only.

Changelog:
  * Fixes problem where disabling all active hosts/services was not taking effect
  * Fixes for compiler warnings (code cleanup by Stephen Gran)
  * Fixes for format errors in event handler logging (Guillaume Rousse)
  * Fixed incorrect info in sample nagios.cfg file for state_retention_file (Michael Friedrich)
  * Fixed broker_event_handler() to return ERR if data is NULL (Michael Friedrich)

PR:		151661
Submitted by:	Alexander Wittig <alexander _at_ wittig.name>
Approved by:	maintainer, glarkin(mentor, implicit)
f6ddfcba0b
Ade Lovett (ade) · 3.2.2_1
Punt autoconf267->autoconf268
6abd00a86b
Ade Lovett (ade) · 3.2.2_1
Autotools update.   Read ports/UPDATING 20100915 for details.

Approved by:	portmgr (for Mk/bsd.port.mk part)
Tested by:	Multiple -exp runs
8262a7b51d
Bernhard Froehlich (decke) · 3.2.2
- Update to 3.2.2

PR:		ports/150523
Submitted by:	Jarrod Sayers <jarrod at downtools dot com dot au> (maintainer)
Approved by:	beat (co-mentor, implicit)
e53aa9a4ba
Brian Somers (brian) · 3.2.1
The pre-install requires uid 0.

Not approved by:	maintainer (timeout after 10 days)
Feature safe:		yes
cbf6479d19
Martin Matuska (mm) · 3.2.1
- Update to 3.2.1 [1] - Update maintainer e-mail address [2]

PR:		ports/145463
Submitted by:	myself [1], maintainer [2]
Approved by:	maintainer
cfb6972898
Doug Barton (dougb) · 3.2.0_1
Begin the process of deprecating sysutils/rc_subr by s#. %%RC_SUBR%%#. /etc/rc.subr#
1d6b4b3f91
Dirk Meyer (dinoex) · 3.2.0_1
- update to jpeg-8
ca9c60461c
Philip M. Gollucci (pgollucci) · 3.2.0
- The nagios documentation (http://nagios.sourceforge.net/docs/3_0/faststartup.html) recommends, for faster startup times, pre-caching the configuration file. This patch adds a "nagios_precache" rcvar which controls using the pre-cache startup method.

- also fix a trailing \

PR:             ports/139848
Submitted by:   kimo <kimor79@yahoo.com>
Approved by:    maintainer (Jarrod Sayers <jarrod@netleader.com.au>)
f2207a2a22
Martin Wilke (miwi) · 3.2.0
- Remov empty patch

Reported by:	wen
073a24e5ad
Wen Heping (wen) · 3.2.0
- Minor change of pkg-message.in

PR:		ports/141003
Submitted by:	olli hauer <ohauer@gmx.de>
Approved by:	maintainer
28f8b104b7
Martin Wilke (miwi) · 3.2.0
- Update to 3.2.0

Changelog:
	http://www.nagios.org/development/history/core-3x

PR:		139210
Submitted by:	Jarrod Sayers <jarrod@netleader.com.au> (maintainer)
Runtime test by:Frank Steinborn
af4bf391e6
Dmitry Marakasov (amdmi3) · 3.0.6_3
- Switch SourceForge ports to the new File Release System: categories starting with N
7914161a41
Jeremy Messenger (mezz) · 3.0.6_3
-Repocopy devel/libtool15 -> libtool22 and libltdl15 -> libltdl22. -Update libtool and libltdl to 2.2.6a. -Remove devel/libtool15 and devel/libltdl15. -Fix ports build with libtool22/libltdl22. -Bump ports that depend on libltdl22 due to shared library version change. -Explain what to do update in the UPDATING.

It has been tested with GNOME2, XFCE4, KDE3, KDE4 and other many wm/desktop
and applications in the runtime.

With help:	marcus and kwm
Pointyhat-exp:	a few times by pav
Tested by:	pgollucci, "Romain Tartière" <romain@blogreen.org>, and
		a few MarcusCom CVS users. Also, I might have missed a few.
Repocopy by:	marcus
Approved by:	portmgr
789d75c728
Doug Barton (dougb) · 3.0.6_2
Fix a few "bad example" problems in the rc.d scripts that have been propogated by copy and paste.

1. Primarily the "empty variable" default assignment, which is mostly
${name}_flags="", but fix a few others as well.
2. Where they are not already documented, add the existence of the _flags
(or other deleted empties) option to the comments, and in some cases add
comments from scratch.
3. Replace things that look like:
prefix=%%PREFIX%%
command=${prefix}/sbin/foo
to just use %%PREFIX%%. In many cases the $prefix variable is only used
once, and in some cases it is not used at all.
4. In a few cases remove ${name}_flags from command_args
5. Remove a long-stale comment about putting the port's rc.d script in
/etc/rc.d (which is no longer necessary).

No PORTREVISION bumps because all of these changes are noops.
0175383f0a
Wesley Shields (wxs) · 3.0.6_2
- Address command injection vulnerability

PR:		ports/136187
Submitted by:	Jarrod Sayers <jarrod@netleader.com.au>
Security:	3ebd4cb5-657f-11de-883a-00e0815b8da8
04221e0994
Wesley Shields (wxs) · 3.0.6_1
- Fix runtime problem with embedded perl. - Mark as MAKE_JOBS_UNSAFE. - Stop using DISTVERSION and use PORTVERSION in net-mgmt/nagios.

PR:		ports/134175
Submitted by:	Jarrod Sayers <jarrod@netleader.com.au> (maintainer)
ce03a68eef
Philip M. Gollucci (pgollucci) · 3.0.6
- Mark MAKE_JOBS_UNSAFE=    yes

Approved by:    pav (via irc on #bsdports)
Tested on:      RideCharge TB, and P6 TB
496112748c
Wesley Shields (wxs) · 3.0.6
- Merge UNHANDLED_HACK option from net-mgmt/nagios-devel.  This option   is off by default so do not bump PORTREVISION.

PR:		ports/132712
Submitted by:	Jarrod Sayers <jarrod@netleader.com.au> (maintainer)
e39ca14794
Wesley Shields (wxs) · 3.0.6
Update to Nagios 3.0.6.

- Fix for CGI submission of external commands (writing newlines and
  submitting service comments)
- Fix for Apache group membership in RPM spec file
- Fix for improper notification propagation command processing
- Better out-of-disk-space error handling when writing retention and
  status files
- Disabled adaptive check and eventhandler commands for security reasons
- Fix for reading output from system commands (event handlers, etc) that
  have timed out
- Added wildcard host matching in CGIs
- Fixes for playing audio alerts in CGIs
- Fix for incorrect host status links in status CGI when viewing
  hostgroup summary
- Added support for x509 cert authentication in the CGIs

PR:		ports/129409
Submitted by:	Jarrod Sayers <jarrod@netleader.com.au> (maintainer)
dbd09e2500
Martin Wilke (miwi) · 3.0.5
- Update to 3.0.5

PR:		128596
Submitted by:	Jarrod Sayers <jarrod@netleader.com.au> (maintainer)
169732a70b
Dmitry Marakasov (amdmi3) · 3.0.4_1
- Correct @dirrmtry's outside of %D

PR:		128407
Submitted by:	Jarrod Sayers <jarrod at netleader dot com dot au> (maintainer)
b978b6cd99
Martin Wilke (miwi) · 3.0.4
- Update to 3.0.4

Note:
Included are updated suggestions from ports/128226. The correction to the ping
command has been extended into the online documentation and the -U option
removed as it's not supported. Also, the default for time_change_threshold is
set to that in include/nagios.h.

PR:		128306
Submitted by:	Jarrod Sayers <jarrod@netleader.com.au> (maintainer)
f86079326f
Philip M. Gollucci (pgollucci) · 3.0.3
- repocopy net-mgmt/nagios -> net-mgmt/nagios2   and connect net-mgmt/nagios2 to the build

- Move net-mgmt/nagios-devel -> net-mgmt/nagios
  (v3.0.3)

- Add note to UPDATING

o net-mgmt/nagios [3]
   SF Macro
   USE_RC_SUBR != yes (rename files/nagios.sh.in -> files/nagios.in)
   OPTIONS+= EVENT_BROKER [1]
   use @dirrmtry in pkg-plist

o net-mgmt/nagios12 [2]
   SF Macro
   USE_RC_SUBR != yes (files/nagios.sh.tmpl -> files/nagios.in)
   Conversion to pkg-install, pkg-deinstall, pkg-message
   use @dirrmtry in pkg-plist

o net-mgmt/nagios2 [4]
   SF Macro
   USE_RC_SUBR != yes (rename files/nagios.sh.in -> files/nagios.in)

PRs:    ports/126758 [4]
    ports/126761 [3]
    ports/126754 [2]
    ports/126684 [1]

Submitted by:   Jarrod Sayers <jarrod@netleader.com.au> (maintainer)
Reworked by:    pgollucci - freebsd ports infrastructure changes
Reviewed by:    pgollucci
Approved by:    gabor (mentor)
23c844c03f
Ade Lovett (ade) · 2.12_1
Conversion from (now defunct) autoconf-2.61 to autoconf-2.62

Tested by:	exp build run (erwin)
771ea13f41
Edwin Groothuis (edwin) · 2.12_1
Bump portrevision due to upgrade of devel/gettext.

The affected ports are the ones with gettext as a run-dependency
according to ports/INDEX-7 (5007 of them) and the ones with USE_GETTEXT
in Makefile (29 of them).

PR:             ports/124340
Submitted by:   edwin@
Approved by:    portmgr (pav)
090059a210
Wesley Shields (wxs) · 2.12
Update to 2.12. Minor bug fixes and an XSS fix (security).

PR:		ports/123893
Submitted by:	Jarrod Sayers <jarrod@netleader.com.au>
Approved by:	garga (mentor, implicit)
Security:	http://www.vuxml.org/freebsd/fbd7aa81-2cc1-11dd-8cfb-00e0815b8da8.html
e27bc7a35e
Rong-En Fan (rafan) · 2.11
- Update to 2.11 [1] - Fix wrong mail program path in sample config file [2]

PR:		ports/121866 [1], ports/120320 [2]
Submitted by:	Jarrod Sayers <jarrod at netleader.com.au> (maintainer) [1]
7371ee9d20
Pav Lucistnik (pav) · 2.10_1
- Remove USE_GETOPT_LONG which is a no-op since March 2007
9fc1c4fe89
Wesley Shields (wxs) · 2.10_1
Link with libthr when available.  This should fix the CPU consumption problem.

PR:		ports/120150 ports/119766
Submitted by:	jarrod@netleader.com.au bernd.kuhlen@wetteronline.de
Approved by:	maintainer (implicit) garga (mentor)
4273708f0d
Martin Wilke (miwi) · 2.10
- Update to 2.10

PR:		117742
Submitted by:	Jarrod Sayers <jarrod@netleader.com.au> (maintainer)
0f9f2d223f
Mark Linimon (linimon) · 2.9_2
Switch autoconf dependencies from 2.53 or 2.59 to 2.61.

PR:		ports/116639
Submitted by:	aDe
48420a5ebd
Mark Linimon (linimon) · 2.9_1
Welcome bsd.perl.mk.  Add support for constructs such as USE_PERL5=5.8.0+. Drop support for antique perl.

Work done by:	gabor
Sponsored by:	Google Summer of Code 2007
Hat:		portmgr
9839011ec3
Florent Thoumie (flz) · 2.9_1
- Welcome X.org 7.2 \o/. - Set X11BASE to ${LOCALBASE} for recent ${OSVERSION}. - Bump PORTREVISION for ports intalling files in ${X11BASE}.
d4f0d0048a
Martin Wilke (miwi) · 2.9
- Update to 2.9

Changelog:
- Fix for incorrect performance data file write/append mode options
- Fix for current status of hosts with no host check command defined
- SIGSEGV signals should now be logged again (broken in 2.8)
- Configure script fix for no mail program found/installed on system
- Configure script option bug fixes for cygwin and embedded perl
- Command definitions and host/service plugin perfdata with HTML should now be
  escaped in CGIs
- Patch for incorrect time down percentage in availability CGI
- Updated init script to fix a race condition during restarts

PR:		111505
Submitted by:	Jarrod Sayers <jarrod@netleader.com.au> (maintainer)
89e1c2791d
Rong-En Fan (rafan) · 2.8_1
- Use registered UID and GID. See UPDATING for migration.

PR:		ports/111345
Submitted by:	Jarrod Sayers <jarrod at netleader.com.au> (maintainer)
4c6bb71802
Martin Wilke (miwi) · 2.8
Update to Nagios 2.8: - Bug fix for calculating notification interval with service escalations - Bug fix for using servicegroups in service dependency definitions - Bug fix for bad date format submission in command CGI - Possible segfault fix during restarts when daemon was performing host checks - Fix for missing check timeout in event broker calls - Fix for handling signals under NPTL - Added er

PR:             110262
Submitted by:   Jarrod Sayers <jarrod@netleader.com.au> (maintainer)
0bb055df81
Pav Lucistnik (pav) · 2.7
- Update to 2.7 - Change examples to read freebsd-server instead of linux-server

PR:		ports/108417
Submitted by:	Jarrod Sayers <jarrod@netleader.com.au> (maintainer)
1e277ab80c
Martin Wilke (miwi) · 2.6
- Update to 2.6

PR:		ports/106502
Submitted by:	Jarrod Sayers <jarrod@netleader.com.au> (maintainer)
10e70c4c1b
Renato Botelho (garga) · 2.5
Update to 2.5

PR:		ports/100373
Submitted by:	maintainer
5271cfccd2
Erwin Lansing (erwin) · 2.4
Update to 2.4

PR:		98413
Submitted by:	Jarrod Sayers <jarrod@netleader.com.au> (maintainer)
0f74198d8c
Sam Lawrance (lawrance) · 2.3.1
Update to 2.3.1.

PR:		ports/97328
Submitted by:	Jarrod Sayers <jarrod@netleader.com.au> (maintainer)
100457e3fe