Vulnerability Note VU#206382

Monit fails to properly handle overly long HTTP requests

Overview

Monit is vulnerable to a buffer overflow when processing overly long HTTP requests.

I. Description

Monit is a utility to monitor system processes, files, directories, devices, and remote hosts. It provides a web-based interface that can be used to access the Monit server. There is a buffer overflow vulnerability in the way Monit handles HTTP requests. By supplying an overly long HTTP request, an unauthenticated, remote attacker could execute arbitrary code with privileges of the vulnerable process.

II. Impact

A remote, unauthenticated attacker could execute arbitrary code on the vulnerable system with privileges of the vulnerable process.

III. Solution

Upgrade

Upgrade to Monit version 4.1.1 or later.

Systems Affected

Vendor	Status	Date Notified	Date Updated
Tildeslash	Vulnerable	6-Apr-2004

References

http://www.tildeslash.com/monit/
http://www.tildeslash.com/monit/changes.html
http://www.s-quadra.com/advisories/Adv-20031124.txt
http://www.securityfocus.com/bid/9099
http://forums.gentoo.org/viewtopic.php?t=155764

Credit

This vulnerability was reported by Evgeny Legerov of S-Quadra.

This document was written by Damon Morda.

Other Information

Date Public:	2004-03-31
Date First Published:	2004-04-06
Date Last Updated:	2004-04-06
CERT Advisory:
CVE-ID(s):
NVD-ID(s):
US-CERT Technical Alerts:
Metric:	4.78
Document Revision:	7

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Get Adobe Reader