Description
Multiple off-by-one errors in Nagios Core 3.5.1, 4.0.2, and earlier, and Icinga before 1.8.5, 1.9 before 1.9.4, and 1.10 before 1.10.2 allow remote authenticated users to obtain sensitive information from process memory or cause a denial of service (crash) via a long string in the last key value in the variable list to the process_cgivars function in (1) avail.c, (2) cmd.c, (3) config.c, (4) extinfo.c, (5) histogram.c, (6) notifications.c, (7) outages.c, (8) status.c, (9) statusmap.c, (10) summary.c, and (11) trends.c in cgi/, which triggers a heap-based buffer over-read.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 8 | nagios3 | 3.5.1.dfsg-2+deb8u1 | DLA-1615-1 |
| Debian 7 | icinga | 1.7.1-7 | DSA-2956-1 |
| Debian 6.0 | icinga | 1.0.2-2+squeeze2 | DLA-60-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | nagios3 | 3.5.1.dfsg-2.1ubuntu1.1 | USN-3253-1 |
| Ubuntu 14.04 LTS | nagios3 | 3.5.1-1ubuntu1.1 | USN-3253-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | nagios | 4.4.6-2.5 | openSUSE-SU-2024:11073-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- Icinga - cgi/config.c process_cgivars Function Off-by-One Read Remote Denial of Service EDB-38882 · dos · Dec 16, 2013 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 5
- DLA-60-1 icinga - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-1615-1 nagios3 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-2956-1 icinga - security update Debian Security (DSA / DLA) · Mar 9, 2026
- USN-3253-1 nagios3 vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
- openSUSE-SU-2024:11073-1 nagios-4.4.6-2.5 on GA media SUSE / openSUSE Security Updates · May 7, 2025
References
- MDVSA-2014:004 vendor-advisory
- openSUSE-SU-2014:0069 vendor-advisory
- http://sourceforge.net/p/nagios/nagioscore/ci/d97e03f32741a7d851826b03ed73ff4c9612a866/
- 56316 third-party-advisory
- openSUSE-SU-2014:0097 vendor-advisory
- https://dev.icinga.org/issues/5251
- [debian-lts-announce] 20181224 [SECURITY] [DLA 1615-1] nagios3 security update mailing-list
- https://www.icinga.org/2013/12/17/icinga-security-releases-1-10-2-1-9-4-1-8-5/
- [oss-security] 20131224 Re: CVE request: denial of service in Nagios (process_cgivars()) mailing-list
- 55976 third-party-advisory
- 64363 vdb-entry
- openSUSE-SU-2014:0016 vendor-advisory
- openSUSE-SU-2014:0039 vendor-advisory