monit versions 4.2 and before are vulnerable to these vulns : ------------------------------------------------------------------ 1. Monit HTTP Interface Buffer Overflow Vulnerability ===================================================== Monit implements a simple HTTP interface that supports Basic authentication. This interface suffers from a buffer overflow vulnerability when handling a client that authenticates with malformed credentials. An attacker could send a carefully crafted Authorization header to the monit server and cause the server to either crash or worse to execute arbitrary code with the privileges of the monit user. 2. Off-By-One Overflow in Monit HTTP Interface ============================================== This buffer overflow lies in the handling of POST submissions with entity bodies. If the request body has the exact length of X bytes, monit will write one byte past its designated input buffer. This error can cause the monit server to crash. ------------------------------------------------------------------ Note that an there's a published exploit for the HTTP Interface Buffer Overflow Vulnerability : http://www.securityfocus.com/archive/1/360121 Reproducible: Didn't try Steps to Reproduce:
Fixed in upstream : version 4.2.1 Markus, we need to bump this one (once again) :) Thanks in advance. -K
Bumped. They really should try finding all vulnerabilities first and make a bump afterwards. ;)
Thanks Markus. Ready for a GLSA. -K
GLSA 200404-16 is out -- closing