A vulnerability in Nagstamon could expose user credentials to a remote attacker.

Announced

2014-01-06

Revised

2014-01-06 (revision 2)

Access

remote

Bugs

#476538

Advisory

https://security.gentoo.org/glsa/201401-03

Affected packages

Package	Arch	Vulnerable	Unaffected
net-analyzer/nagstamon	*	< 0.9.11_rc1	>= 0.9.11_rc1

Background

Nagstamon is a Nagios status monitor application.

Description

Nagstamon’s automatic request to check for updates includes plaintext username and password information for one of the monitor servers that the Nagstamon instance connects to.

Impact

A remote attacker could eavesdrop on this request and gain user credentials for a monitor server.

Workaround

There is no known workaround at this time.

Resolution

All Nagstamon users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose
">=net-analyzer/nagstamon-0.9.11_rc1"

References

• CVE-2013-4114