Vulnerability identifier: #VU40381

Vulnerability risk: Low

CVSSv3.1: 2.9 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2016-2057

CWE-ID: CWE-264

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Xymon
Web applications / Remote management & hosting panels
Debian Linux
Operating systems & Components / Operating system

Vendor: GNU
Debian

Description

The vulnerability allows a local authenticated user to manipulate data.

lib/xymond_ipc.c in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 use weak permissions (666) for an unspecified IPC message queue, which allows local users to inject arbitrary messages by writing to that queue.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Xymon: 4.1.0 - 4.3.24

Debian Linux: 4.1.0 - 8.0

---

External links
http://packetstormsecurity.com/files/135758/Xymon-4.3.x-Buffer-Overflow-Code-Execution-Information-Disclosure.html
http://www.debian.org/security/2016/dsa-3495
http://www.securityfocus.com/archive/1/537522/100/0/threaded
http://sourceforge.net/p/xymon/code/7891/

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.