CVE-2013-7108

CVE-2013-7108

Published · Updated

35Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendepss 62%
from disclosure to weapon0 days
Published on NVDJan 14
1st PoCDec 16
exploitation probability
62%top 1% of all CVEs
observed exploitation
nono source reports it
1 public exploit(s)
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Affected
4 products
Red Hat Enterprise Linux OpenStack Platform 5 (Icehouse) · Red Hat Enterprise Linux OpenStack Platform 6 (Juno) · Red Hat OpenStack Platform 3 · Red Hat OpenStack Platform 4
none_available: Fix deferred
Multiple off-by-one errors in Nagios Core 3.5.1, 4.0.2, and earlier, and Icinga before 1.8.5, 1.9 before 1.9.4, and 1.10 before 1.10.2 allow remote authenticated users to obtain sensitive information from process memory or cause a denial of service (crash) via a long string in the last key value in the variable list to the process_cgivars function in (1) avail.c, (2) cmd.c, (3) config.c, (4) extinfo.c, (5) histogram.c, (6) notifications.c, (7) outages.c, (8) status.c, (9) statusmap.c, (10) summary.c, and (11) trends.c in cgi/, which triggers a heap-based buffer over-read.
Affected products
n/a · n/a
public PoCs found — 1✓ VexDay Proof
exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/38882
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
References
http://lists.opensuse.org/opensuse-updates/2014-01/msg00010.htmlhttp://lists.opensuse.org/opensuse-updates/2014-01/msg00028.htmlhttp://lists.opensuse.org/opensuse-updates/2014-01/msg00046.htmlhttp://lists.opensuse.org/opensuse-updates/2014-01/msg00068.htmlhttps://dev.icinga.org/issues/5251http://secunia.com/advisories/55976http://secunia.com/advisories/56316https://lists.debian.org/debian-lts-announce/2018/12/msg00014.htmlhttp://sourceforge.net/p/nagios/nagioscore/ci/d97e03f32741a7d851826b03ed73ff4c9612a866/https://www.icinga.org/2013/12/17/icinga-security-releases-1-10-2-1-9-4-1-8-5/http://www.mandriva.com/security/advisories?name=MDVSA-2014:004http://www.openwall.com/lists/oss-security/2013/12/24/1