Description
munin-cgi-graph for Munin 2.0 rc4 does not delete temporary files, which allows remote attackers to cause a denial of service (disk consumption) via many requests to an image with unique parameters.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | munin | 2.0~rc6-1 | — |
| Debian 13 | munin | 2.0~rc6-1 | — |
| Debian 12 | munin | 2.0~rc6-1 | — |
References
- [oss-security] 20120419 Re: [Packaging] Bug#668667: CVE Request (minor) -- Two Munin graphing framework flaws mailing-list
- [oss-security] 20120427 Re: Bug#668667: CVE Request (minor) -- Two Munin graphing framework flaws mailing-list
- [oss-security] 20120417 Re: CVE Request (minor) -- Two Munin graphing framework flaws mailing-list
- [oss-security] 20120418 Re: Bug#668667: CVE Request (minor) -- Two Munin graphing framework flaws mailing-list
- [oss-security] 20120418 Re: CVE Request (minor) -- Two Munin graphing framework flaws mailing-list
- [oss-security] 20120429 Re: Bug#668667: CVE Request (minor) -- Two Munin graphing framework flaws mailing-list
- [oss-security] 20120416 Re: CVE Request (minor) -- Two Munin graphing framework flaws mailing-list
- http://munin-monitoring.org/changeset/4825
- [oss-security] 20120416 CVE Request (minor) -- Two Munin graphing framework flaws mailing-list
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=668667
- https://bugzilla.redhat.com/show_bug.cgi?id=812889
- 53034 vdb-entry