=========================================================================== Ubuntu Security Notice USN-3253-2 June 07, 2017 nagios3 regression =========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 17.04 - Ubuntu 16.10 - Ubuntu 16.04 LTS - Ubuntu 14.04 LTS Summary: USN-3253-1 introduced a regression in Nagios. Software Description: - nagios3: host/service/network monitoring and management system Details: USN-3253-1 fixed vulnerabilities in Nagios. The update prevented log files from being displayed in the web interface. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that Nagios incorrectly handled certain long strings. A remote authenticated attacker could use this issue to cause Nagios to crash, resulting in a denial of service, or possibly obtain sensitive information. (CVE-2013-7108, CVE-2013-7205) It was discovered that Nagios incorrectly handled certain long messages to cmd.cgi. A remote attacker could possibly use this issue to cause Nagios to crash, resulting in a denial of service. (CVE-2014-1878) Dawid Golunski discovered that Nagios incorrectly handled symlinks when accessing log files. A local attacker could possibly use this issue to elevate privileges. In the default installation of Ubuntu, this should be prevented by the Yama link restrictions. (CVE-2016-9566) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 17.04: nagios3-cgi 3.5.1.dfsg-2.1ubuntu5.2 nagios3-core 3.5.1.dfsg-2.1ubuntu5.2 Ubuntu 16.10: nagios3-cgi 3.5.1.dfsg-2.1ubuntu3.3 nagios3-core 3.5.1.dfsg-2.1ubuntu3.3 Ubuntu 16.04 LTS: nagios3-cgi 3.5.1.dfsg-2.1ubuntu1.3 nagios3-core 3.5.1.dfsg-2.1ubuntu1.3 Ubuntu 14.04 LTS: nagios3-cgi 3.5.1-1ubuntu1.3 nagios3-core 3.5.1-1ubuntu1.3 In general, a standard system update will make all the necessary changes. References: https://www.ubuntu.com/usn/usn-3253-2 https://www.ubuntu.com/usn/usn-3253-1 https://launchpad.net/bugs/1690380 Package Information: https://launchpad.net/ubuntu/+source/nagios3/3.5.1.dfsg-2.1ubuntu5.2 https://launchpad.net/ubuntu/+source/nagios3/3.5.1.dfsg-2.1ubuntu3.3 https://launchpad.net/ubuntu/+source/nagios3/3.5.1.dfsg-2.1ubuntu1.3 https://launchpad.net/ubuntu/+source/nagios3/3.5.1-1ubuntu1.3 --tBnGudiknfNusXNDKeFViqOc38en0Ra03--