Multiple Vulnerabilities in Monit

I=2E Product Description

As quoted from http://www=2Etildeslash=2Ecom/monit/ web page:

"monit is a utility for managing and monitoring, processes, files,
directories and devices on a Unix system=2E Monit conducts automatic
maintenance and repair and can execute meaningful causal actions in error
situations=2E E=2Eg=2E monit can start a process if it does not run, resta=
rt a
process if it does not respond and stop a process if it uses to much
resources=2E You may use monit to monitor files, directories and devices f=
or
changes, such as timestamp changes, checksum changes or size changes=2E Yo=
u
can also use monit to monitor remote hosts; monit can ping a remote host
and can check port connections and protocols=2E"

II=2E Affected Systems

Stable: Monit 4=2E2 and prior
Beta: Monit 4=2E3 Beta 2 and prior

III=2E Vulnerability Description

Three vulnerabilities were found in Monit during a simple code review=2E =
All
of the vulnerabilities are in Monit's HTTP/HTTPS administration interfaces=
,
and as such can only be exploited if the interface is enabled and
accessible=2E Two of the vulnerabilities lie in the Basic authentication
code, while one vulnerability lies in the processing of POST requests=2E =20=


* Basic Authentication Out-of-Bounds Read (Denial of Service)

When faced with a Basic authentication request without a password, Monit
will decrement a pointer returned by a strchr() call without appropriate
NULL pointer checking=2E The error results in a segmentation fault during=
a
strcpy() call=2E This request can be generated with a simple web browser=2E=
=20
This vulnerability does not allow users to gain privileges on the server=2E=
=20
For instance=2E Specifically, if the base64-decoded credentials string do=
es
not contain a colon, the vulnerability can be exploited=2E

* Basic Authentication Buffer Overflow (Remote Root)

When faced with a Basic authentication request with an overly-long user
name (> 256 characters), vulnerable versions of Monit will overrun a
stack-based buffer=2E This potentially allows a remote attacker to gain r=
oot
privileges=2E

* POST Input Off-By-One (Exploitability Varies)

When faced with a POST submission that is exactly 1,024 bytes, Monit
suffers from an off-by-one overflow=2E Exploitability depends upon the
version of gcc used to compile the application=2E Some compilers will all=
ow
this overflow to modify the frame pointer, potentially controlling stack
frames=2E

* UPDATE: Integer Overflow in POST Input Handler (Initially discovered by
S-Quadra)

S-Quadra discovered that a large HTTP POST would cause an xmalloc() call
within the WBA to fail=2E This issue was fixed in 4=2E2=2E1 as a denial o=
f
service=2E In fact, this code also contained an exploitable integer
overflow=2E By specifying a Content-Length header of -1, a zero-byte heap=

allocation is performed=2E An attacker can then input an arbitrary amount=
of
data, overwriting significant portions of the heap=2E My research suggest=
s
that this issue could also be exploited=2E

IV=2E Impact

A remote attacker with access to Monit's WBA via HTTP or HTTPS clients
could potentially gain the privileges of the root user=2E

V=2E Vendor Response

April 3, 2004:
* First two vulnerabilities discovered
* Monit team notified via e-mail (monitgroup@tildeslash=2Ecom)
April 4, 2004:
* Response from Jan Henrik-Haukeland (hauk@tildeslash=2Ecom)
* Patch for first two reports committed to CVS
* Third vulnerability discovered
* Monit team notified via e-mail (monitgroup@tildeslash=2Ecom)
April 5, 2004:
* Response from Jan Henrik-Haukeland (hauk@tildeslash=2Ecom)
* Patch for third issue committed to CVS
* Monit team releases security advisory
* Monit 4=2E2=2E1 released
* Monit 4=2E3 Beta 3 released
* Public disclosure

The Monit team deserves praise on a very speedy response to this
vulnerability=2E Particularly noteworthy is that the vendor was notified
shortly before midnight on April 4, 2004=2E The patch for each of these
issues was committed to CVS within 18 hours of the initial report=2E Than=
ks
to Jan Henrik-Haukeland for a fast response to this issue=2E

VI=2E Workaround

For those who cannot immediately upgrade packages, it is recommended that
the Monit HTTP interface be disabled=2E If access to this interface is
necessary, limit it to the Local Area Network with appropriate firewalling=
=2E
Upgrading as listed in "Solution" below is recommended if possible=2E For=

those users of Monit who have deployed vendor-provided packages, you shoul=
d
wait for updated vendor binaries=2E

VII=2E Solution

* Monit 4=2E2 Stable:

The vendor has released Monit 4=2E2=2E1, which contains these fixes=2E It=
can be
downloaded at:

http://www=2Etildeslash=2Ecom/monit/...2E1=2Etar=2Egz
MD5 Checksum: http://www=2Etildeslash=2Ecom/monit/...4=2E2=2E1=2Et=
ar=2Egz=2Emd5

* Monit 4=2E3 Beta:

The vendor has released Monit 4=2E3 Beta 3, which contains these fixes=2E =
It
can be downloaded at:

http://www=2Etildeslash=2Ecom/monit/...ta3=2Etar=2Egz
MD5 Checksum:
http://www=2Etildeslash=2Ecom/monit/...tar=2Egz=2Emd=
5

The vendor has released a security advisory documenting these
vulnerabilities:

http://www=2Etildeslash=2Ecom/monit/...20040305=2Etxt

--------------------------------------------------------------------
mail2web - Check your email from the web at
http://mail2web=2Ecom/ =2E