Security update for icinga SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2018:3620-1 Final 1 1 2018-11-05T16:57:03Z current 2018-11-05T16:57:03Z 2018-11-05T16:57:03Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for icinga This update for icinga fixes the following issues: Security issues fixed: - CVE-2015-8010: Fixed XSS in the icinga classic UI (boo#952777) - CVE-2016-8641 / CVE-2016-10089: fixed a possible symlink attack for files/dirs created by root (boo#1011630 and boo#1018047) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-SLE-Manager-Tools-12-2018-2580,SUSE-Storage-4-2018-2580 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2018/suse-su-20183620-1/ Link for SUSE-SU-2018:3620-1 https://lists.suse.com/pipermail/sle-security-updates/2018-November/004828.html E-Mail link for SUSE-SU-2018:3620-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1011630 SUSE Bug 1011630 https://bugzilla.suse.com/1018047 SUSE Bug 1018047 https://bugzilla.suse.com/952777 SUSE Bug 952777 https://www.suse.com/security/cve/CVE-2015-8010/ SUSE CVE CVE-2015-8010 page https://www.suse.com/security/cve/CVE-2016-10089/ SUSE CVE CVE-2016-10089 page https://www.suse.com/security/cve/CVE-2016-8641/ SUSE CVE CVE-2016-8641 page SUSE Enterprise Storage 4 SUSE Manager Tools 12 icinga-1.13.3-12.3.1 icinga-devel-1.13.3-12.3.1 icinga-doc-1.13.3-12.3.1 icinga-idoutils-1.13.3-12.3.1 icinga-idoutils-mysql-1.13.3-12.3.1 icinga-idoutils-oracle-1.13.3-12.3.1 icinga-idoutils-pgsql-1.13.3-12.3.1 icinga-plugins-downtimes-1.13.3-12.3.1 icinga-plugins-eventhandlers-1.13.3-12.3.1 icinga-www-1.13.3-12.3.1 icinga-www-config-1.13.3-12.3.1 monitoring-tools-1.13.3-12.3.1 icinga-1.13.3-12.3.1 as a component of SUSE Enterprise Storage 4 icinga-1.13.3-12.3.1 as a component of SUSE Manager Tools 12 icinga-devel-1.13.3-12.3.1 as a component of SUSE Manager Tools 12 icinga-doc-1.13.3-12.3.1 as a component of SUSE Manager Tools 12 icinga-idoutils-1.13.3-12.3.1 as a component of SUSE Manager Tools 12 icinga-idoutils-mysql-1.13.3-12.3.1 as a component of SUSE Manager Tools 12 icinga-idoutils-oracle-1.13.3-12.3.1 as a component of SUSE Manager Tools 12 icinga-idoutils-pgsql-1.13.3-12.3.1 as a component of SUSE Manager Tools 12 icinga-plugins-downtimes-1.13.3-12.3.1 as a component of SUSE Manager Tools 12 icinga-plugins-eventhandlers-1.13.3-12.3.1 as a component of SUSE Manager Tools 12 icinga-www-1.13.3-12.3.1 as a component of SUSE Manager Tools 12 icinga-www-config-1.13.3-12.3.1 as a component of SUSE Manager Tools 12 monitoring-tools-1.13.3-12.3.1 as a component of SUSE Manager Tools 12 Cross-site scripting (XSS) vulnerability in the Classic-UI with the CSV export link and pagination feature in Icinga before 1.14 allows remote attackers to inject arbitrary web script or HTML via the query string to cgi-bin/status.cgi. CVE-2015-8010 SUSE Enterprise Storage 4:icinga-1.13.3-12.3.1 SUSE Manager Tools 12:icinga-1.13.3-12.3.1 SUSE Manager Tools 12:icinga-devel-1.13.3-12.3.1 SUSE Manager Tools 12:icinga-doc-1.13.3-12.3.1 SUSE Manager Tools 12:icinga-idoutils-1.13.3-12.3.1 SUSE Manager Tools 12:icinga-idoutils-mysql-1.13.3-12.3.1 SUSE Manager Tools 12:icinga-idoutils-oracle-1.13.3-12.3.1 SUSE Manager Tools 12:icinga-idoutils-pgsql-1.13.3-12.3.1 SUSE Manager Tools 12:icinga-plugins-downtimes-1.13.3-12.3.1 SUSE Manager Tools 12:icinga-plugins-eventhandlers-1.13.3-12.3.1 SUSE Manager Tools 12:icinga-www-1.13.3-12.3.1 SUSE Manager Tools 12:icinga-www-config-1.13.3-12.3.1 SUSE Manager Tools 12:monitoring-tools-1.13.3-12.3.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20183620-1/ https://www.suse.com/security/cve/CVE-2015-8010.html CVE-2015-8010 https://bugzilla.suse.com/952777 SUSE Bug 952777 Nagios 4.3.2 and earlier allows local users to gain root privileges via a hard link attack on the Nagios init script file, related to CVE-2016-8641. CVE-2016-10089 SUSE Enterprise Storage 4:icinga-1.13.3-12.3.1 SUSE Manager Tools 12:icinga-1.13.3-12.3.1 SUSE Manager Tools 12:icinga-devel-1.13.3-12.3.1 SUSE Manager Tools 12:icinga-doc-1.13.3-12.3.1 SUSE Manager Tools 12:icinga-idoutils-1.13.3-12.3.1 SUSE Manager Tools 12:icinga-idoutils-mysql-1.13.3-12.3.1 SUSE Manager Tools 12:icinga-idoutils-oracle-1.13.3-12.3.1 SUSE Manager Tools 12:icinga-idoutils-pgsql-1.13.3-12.3.1 SUSE Manager Tools 12:icinga-plugins-downtimes-1.13.3-12.3.1 SUSE Manager Tools 12:icinga-plugins-eventhandlers-1.13.3-12.3.1 SUSE Manager Tools 12:icinga-www-1.13.3-12.3.1 SUSE Manager Tools 12:icinga-www-config-1.13.3-12.3.1 SUSE Manager Tools 12:monitoring-tools-1.13.3-12.3.1 moderate 6.9 AV:L/AC:M/Au:N/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20183620-1/ https://www.suse.com/security/cve/CVE-2016-10089.html CVE-2016-10089 https://bugzilla.suse.com/1011630 SUSE Bug 1011630 https://bugzilla.suse.com/1018047 SUSE Bug 1018047 A privilege escalation vulnerability was found in nagios 4.2.x that occurs in daemon-init.in when creating necessary files and insecurely changing the ownership afterwards. It's possible for the local attacker to create symbolic links before the files are to be created and possibly escalating the privileges with the ownership change. CVE-2016-8641 SUSE Enterprise Storage 4:icinga-1.13.3-12.3.1 SUSE Manager Tools 12:icinga-1.13.3-12.3.1 SUSE Manager Tools 12:icinga-devel-1.13.3-12.3.1 SUSE Manager Tools 12:icinga-doc-1.13.3-12.3.1 SUSE Manager Tools 12:icinga-idoutils-1.13.3-12.3.1 SUSE Manager Tools 12:icinga-idoutils-mysql-1.13.3-12.3.1 SUSE Manager Tools 12:icinga-idoutils-oracle-1.13.3-12.3.1 SUSE Manager Tools 12:icinga-idoutils-pgsql-1.13.3-12.3.1 SUSE Manager Tools 12:icinga-plugins-downtimes-1.13.3-12.3.1 SUSE Manager Tools 12:icinga-plugins-eventhandlers-1.13.3-12.3.1 SUSE Manager Tools 12:icinga-www-1.13.3-12.3.1 SUSE Manager Tools 12:icinga-www-config-1.13.3-12.3.1 SUSE Manager Tools 12:monitoring-tools-1.13.3-12.3.1 moderate 4.4 AV:L/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20183620-1/ https://www.suse.com/security/cve/CVE-2016-8641.html CVE-2016-8641 https://bugzilla.suse.com/1011630 SUSE Bug 1011630 https://bugzilla.suse.com/1018047 SUSE Bug 1018047