Description
The administration interface in Monit 1.4 through 4.2 allows remote attackers to cause an off-by-one overflow via a POST that contains 1024 bytes.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | monit | 1:4.2.1 | — |
| Debian 13 | monit | 1:4.2.1 | — |
| Debian 12 | monit | 1:4.2.1 | — |
References
- monit-post-offbyone-bo(15736) vdb-entry
- http://www.tildeslash.com/monit/changes.html
- 10051 vdb-entry
- http://www.tildeslash.com/monit/secadv_20040305.txt
- 20040405 Advisory: Multiple Vulnerabilities in Monit mailing-list
- 11304 third-party-advisory
- 4979 vdb-entry
- 20040405 [VulnWatch] Advisory: Multiple Vulnerabilities in Monit mailing-list