lib/xymond_ipc.c in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 use weak permissions (666) for an unspecified IPC message queue, which allows local users to inject arbitrary messages by writing to that queue.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Xymon | Xymon | 4.1.0 (including) | 4.1.0 (including) |
| Xymon | Xymon | 4.1.1 (including) | 4.1.1 (including) |
| Xymon | Xymon | 4.1.2 (including) | 4.1.2 (including) |
| Xymon | Xymon | 4.1.2-p1 (including) | 4.1.2-p1 (including) |
| Xymon | Xymon | 4.1.2-p2 (including) | 4.1.2-p2 (including) |
| Xymon | Xymon | 4.2-alfa (including) | 4.2-alfa (including) |
| Xymon | Xymon | 4.2-beta20060605 (including) | 4.2-beta20060605 (including) |
| Xymon | Xymon | 4.2-rc20060712 (including) | 4.2-rc20060712 (including) |
| Xymon | Xymon | 4.2.0 (including) | 4.2.0 (including) |
| Xymon | Xymon | 4.2.2 (including) | 4.2.2 (including) |
| Xymon | Xymon | 4.2.2-rc1 (including) | 4.2.2-rc1 (including) |
| Xymon | Xymon | 4.2.3 (including) | 4.2.3 (including) |
| Xymon | Xymon | 4.2.3-rc1 (including) | 4.2.3-rc1 (including) |
| Xymon | Xymon | 4.3.0 (including) | 4.3.0 (including) |
| Xymon | Xymon | 4.3.0-beta1 (including) | 4.3.0-beta1 (including) |
| Xymon | Xymon | 4.3.0-beta2 (including) | 4.3.0-beta2 (including) |
| Xymon | Xymon | 4.3.0-beta3 (including) | 4.3.0-beta3 (including) |
| Xymon | Xymon | 4.3.0-rc1 (including) | 4.3.0-rc1 (including) |
| Xymon | Xymon | 4.3.1 (including) | 4.3.1 (including) |
| Xymon | Xymon | 4.3.2 (including) | 4.3.2 (including) |
| Xymon | Xymon | 4.3.3 (including) | 4.3.3 (including) |
| Xymon | Xymon | 4.3.4 (including) | 4.3.4 (including) |
| Xymon | Xymon | 4.3.5 (including) | 4.3.5 (including) |
| Xymon | Xymon | 4.3.6 (including) | 4.3.6 (including) |
| Xymon | Xymon | 4.3.7 (including) | 4.3.7 (including) |
| Xymon | Xymon | 4.3.8 (including) | 4.3.8 (including) |
| Xymon | Xymon | 4.3.9 (including) | 4.3.9 (including) |
| Xymon | Xymon | 4.3.10 (including) | 4.3.10 (including) |
| Xymon | Xymon | 4.3.11 (including) | 4.3.11 (including) |
| Xymon | Xymon | 4.3.12 (including) | 4.3.12 (including) |
| Xymon | Xymon | 4.3.13 (including) | 4.3.13 (including) |
| Xymon | Xymon | 4.3.14 (including) | 4.3.14 (including) |
| Xymon | Xymon | 4.3.15 (including) | 4.3.15 (including) |
| Xymon | Xymon | 4.3.16 (including) | 4.3.16 (including) |
| Xymon | Xymon | 4.3.17 (including) | 4.3.17 (including) |
| Xymon | Xymon | 4.3.18 (including) | 4.3.18 (including) |
| Xymon | Xymon | 4.3.19 (including) | 4.3.19 (including) |
| Xymon | Xymon | 4.3.19-rc1 (including) | 4.3.19-rc1 (including) |
| Xymon | Xymon | 4.3.20 (including) | 4.3.20 (including) |
| Xymon | Xymon | 4.3.21 (including) | 4.3.21 (including) |
| Xymon | Xymon | 4.3.22 (including) | 4.3.22 (including) |
| Xymon | Xymon | 4.3.23 (including) | 4.3.23 (including) |
| Xymon | Xymon | 4.3.24 (including) | 4.3.24 (including) |
| Xymon | Ubuntu | precise | * |
| Xymon | Ubuntu | trusty | * |
| Xymon | Ubuntu | upstream | * |
| Xymon | Ubuntu | wily | * |
References
- http://packetstormsecurity.com/files/135758/Xymon-4.3.x-Buffer-Overflow-Code-Execution-Information-Disclosure.html
- http://www.debian.org/security/2016/dsa-3495
- http://www.securityfocus.com/archive/1/537522/100/0/threaded
- https://sourceforge.net/p/xymon/code/7891/
- http://packetstormsecurity.com/files/135758/Xymon-4.3.x-Buffer-Overflow-Code-Execution-Information-Disclosure.html
- http://www.debian.org/security/2016/dsa-3495
- http://www.securityfocus.com/archive/1/537522/100/0/threaded
- https://sourceforge.net/p/xymon/code/7891/