CVE-2016-2057 lib/xymond_ipc.c in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 use weak permissions (666) for an unspecified IPC message queue, which allows local users to inject arbitrary messages by writing to tha...
LowCVSS 3.3
EPSS 0.47%
- Published
- Updated
- Exploit status
- No public exploit known
Description
lib/xymond_ipc.c in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 use weak permissions (666) for an unspecified IPC message queue, which allows local users to inject arbitrary messages by writing to that queue.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/xymon(Debian:12) | < 4.3.25-1 | 4.3.25-1 |
| debian/xymon(Debian:13) | < 4.3.25-1 | 4.3.25-1 |
| debian/xymon(Debian:14) | < 4.3.25-1 | 4.3.25-1 |
| xymon | = 4.1.0 | No fix listed |
| xymon | = 4.1.1 | No fix listed |
| xymon | = 4.1.2 | No fix listed |
| xymon | = 4.1.2-p1 | No fix listed |
| xymon | = 4.1.2-p2 | No fix listed |
| xymon | = 4.2-alfa | No fix listed |
| xymon | = 4.2-beta20060605 | No fix listed |
| xymon | = 4.2-rc20060712 | No fix listed |
| xymon | = 4.2.0 | No fix listed |
| xymon | = 4.2.2 | No fix listed |
| xymon | = 4.2.2-rc1 | No fix listed |
| xymon | = 4.2.3 | No fix listed |
| xymon | = 4.2.3-rc1 | No fix listed |
| xymon | = 4.3.0 | No fix listed |
| xymon | = 4.3.0-beta1 | No fix listed |
| xymon | = 4.3.0-beta2 | No fix listed |
| xymon | = 4.3.0-beta3 | No fix listed |
| xymon | = 4.3.0-rc1 | No fix listed |
| xymon | = 4.3.1 | No fix listed |
| xymon | = 4.3.2 | No fix listed |
| xymon | = 4.3.3 | No fix listed |
| xymon | = 4.3.4 | No fix listed |
Show 22 more
| Product | Affected versions | Fixed in |
|---|---|---|
| xymon | = 4.3.5 | No fix listed |
| xymon | = 4.3.6 | No fix listed |
| xymon | = 4.3.7 | No fix listed |
| xymon | = 4.3.8 | No fix listed |
| xymon | = 4.3.9 | No fix listed |
| xymon | = 4.3.10 | No fix listed |
| xymon | = 4.3.11 | No fix listed |
| xymon | = 4.3.12 | No fix listed |
| xymon | = 4.3.13 | No fix listed |
| xymon | = 4.3.14 | No fix listed |
| xymon | = 4.3.15 | No fix listed |
| xymon | = 4.3.16 | No fix listed |
| xymon | = 4.3.17 | No fix listed |
| xymon | = 4.3.18 | No fix listed |
| xymon | = 4.3.19 | No fix listed |
| xymon | = 4.3.19-rc1 | No fix listed |
| xymon | = 4.3.20 | No fix listed |
| xymon | = 4.3.21 | No fix listed |
| xymon | = 4.3.22 | No fix listed |
| xymon | = 4.3.23 | No fix listed |
| xymon | = 4.3.24 | No fix listed |
| debian linux | = 8.0 | No fix listed |
References
- Debian Security Tracker CVE-2016-2057 vendor-advisory
- packetstormsecurity.com
- DSA-3495 vendor-advisory
- 20160214 Xymon: Critical security issues in all versions prior to 4.3.25 mailing-list
- sourceforge.net patch