|
|
| |
Monit is "a utility for managing and monitoring, processes, files, directories and devices on a UNIX system. It conducts automatic maintenance and repair and can execute meaningful causal actions in error situations. Monit provides a HTTP(S) interface and you can use a browser to access the Monit server".
There exist several security vulnerabilities in Monit HTTP interface, which could allow an attacker in the worst case to gain root access to the system. |
| |
Credit:
The information has been provided by S-Quadra Security Research.
|
| |
Vulnerable systems:
* Monit version 4.1
Immune systems:
* Monit version 4.1.1
Long HTTP Method Stack Overflow
By supplying an overly large http request method and attacker could trigger a stack overflow condition which may lead to a remote root compromise.
Denial of Service via Negative Content-Length Field
By supplying a negative value in Content-Length header an attacker could cause a xmalloc() failure and kill a Monit daemon.
Solution:
S-Quadra alerted Monit development team to this issue on 21st November 2003. New version of Monit 4.1.1 is available at http://www.tildeslash.com/monit/dist/monit-4.1.1.tar.gz which fixes the reported security vulnerabilities.
|
|
|
