← back
CVE-2012-6096

CVE-2012-6096

EPSS 66.5%
Multiple stack-based buffer overflows in the get_history function in history.cgi in Nagios Core before 3.4.4, and Icinga 1.6.x before 1.6.2, 1.7.x before 1.7.4, and 1.8.x before 1.8.4, might allow remote attackers to execute arbitrary code via a long (1) host_name variable (host parameter) or (2) svc_description variable.
Affected products
n/a · n/a
public PoCs found — 4
cve_referencewww.exploit-db.com/exploits/24084unverifiedcve_referencewww.exploit-db.com/exploits/24159unverifiedexploitdbwww.exploit-db.com/exploits/24159unverifiedexploitdbwww.exploit-db.com/exploits/24084unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
http://lists.grok.org.uk/pipermail/full-disclosure/2012-December/089125.htmlhttp://lists.opensuse.org/opensuse-updates/2013-01/msg00033.htmlhttp://lists.opensuse.org/opensuse-updates/2013-01/msg00060.htmlhttp://lists.opensuse.org/opensuse-updates/2013-01/msg00077.htmlhttp://lists.opensuse.org/opensuse-updates/2013-01/msg00088.htmlhttps://bugzilla.redhat.com/show_bug.cgi?id=893269https://dev.icinga.org/issues/3532http://secunia.com/advisories/51863https://www.icinga.org/2013/01/14/icinga-1-6-2-1-7-4-1-8-4-released/http://www.debian.org/security/2013/dsa-2616http://www.debian.org/security/2013/dsa-2653http://www.exploit-db.com/exploits/24084