Stack-based buffer overflow in Xymon - CVE-2019-13485

Detailed vulnerability description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing a long hostname or service parameter in history.c within the in the history viewer component. A remote authenticated attacker can trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

How to mitigate CVE-2019-13485

Sources

• https://github.com/svn2github/xymon/blob/master/branches/4.3.28/web/history.c
• https://lists.debian.org/debian-lts-announce/2019/08/msg00032.html
• https://lists.xymon.com/archive/2019-July/046570.html