On 7/24/2019 7:01 AM, Stephen Carville (xymon list) wrote:

On 7/23/19 9:08 AM, Japheth Cleaver wrote:

...

Lereta Email Checkpoint: External email. Please make sure you trust this source before clicking links or opening attachments.

---

Just an FYI. When I updated my CentOS 7 xymon server by building from source, it refused to include the openssl libraries until I installed the libtirpc-devel package. Not sure why it is necessary.

Thanks, I'll make a note of that on the RPM site. The underlying reason here is that GCC's rpc interface was removed after a long deprecation, in favor of libtirpc. It was easier to simply test for that and move forward on use. This will also be necessary for 4.4 (IPv6) and was the main cause of the recent Fedora FTBFS's.

https://fedoraproject.org/wiki/Changes/SunRPCRemoval

Regards, -jc

Japheth and Xymon 4.3.29 users, Attached is a context diff patch file for the Xymon 4.3.29 release to address the following issues:

Bug Fixes:

• build/Makefile.Linux Use tirpc replacement only on glibc 2.26 and later. This fixes compiling and RPC issues on RHEL6 and RHEL7 platforms.

• lib/*.c files and xymonnet/xymonnet.c: Only use the "#pragma GCC diagnostic" options on gcc 4.5 and later. This fixes compiling on RHEL6.

Enhancements:

• web/showgraph.c: Change underscore to space as this is a common mangling on temperature and lic backends

• xymond/etcfiles/graphs.cfg and xymond/rrd/do_disk.c: Change disk sizes from KB to auto-scaling (i.e. GB, TB) Add FlexLM license graph for lic backend.

• xymond/rrd/do_temperature.c:

  • Strip off any bold and italic HTML tags on temperature sensor name

Thank you again for maintaining Xymon once again. Please include my recommend patches so the it compiles on RHEL6/7 platforms without issue.

Tom Schmidt Sr Manager, IT, Product Engineering IT ETD Eng Sites US Micron Technology, Inc. Office:?+1 (208) 368-4058 ?Fax:?(208)368-2807 Email:?tschmidt at micron.com? Website:?micron.com Micron Technology, Inc., Confidential and Proprietary.

-----Original Message----- From: Xymon <xymon-bounces at xymon.com> On Behalf Of Japheth Cleaver Sent: Wednesday, July 24, 2019 7:40 PM To: Stephen Carville (xymon list) <scarville at lereta.com>; xymon at xymon.com Subject: [EXT] Re: [Xymon] Xymon 4.3.29 Released - Important Security Update

On 7/24/2019 7:01 AM, Stephen Carville (xymon list) wrote:

On 7/23/19 9:08 AM, Japheth Cleaver wrote:

...

Lereta Email Checkpoint: External email. Please make sure you trust this source before clicking links or opening attachments.

---

Just an FYI. When I updated my CentOS 7 xymon server by building from source, it refused to include the openssl libraries until I installed the libtirpc-devel package. Not sure why it is necessary.

Thanks, I'll make a note of that on the RPM site. The underlying reason here is that GCC's rpc interface was removed after a long deprecation, in favor of libtirpc. It was easier to simply test for that and move forward on use. This will also be necessary for 4.4 (IPv6) and was the main cause of the recent Fedora FTBFS's.

https://nam01.safelinks.protection.outlook.com/?url=https%3A%2F%2Ffedoraproject.org%2Fwiki%2FChanges%2FSunRPCRemoval&data=02%7C01%7Ctschmidt%40micron.com%7C5ba545ffc6bf46e2b2a508d710a109bd%7Cf38a5ecd28134862b11bac1d563c806f%7C0%7C0%7C636996156155520395&sdata=piP%2FSxXJ6rgvDb4Bea6PRKuxHE%2BPlAfvLehL0xGkZSw%3D&reserved=0

Regards, -jc

Xymon mailing list Xymon at xymon.com https://nam01.safelinks.protection.outlook.com/?url=http%3A%2F%2Flists.xymon.com%2Fmailman%2Flistinfo%2Fxymon&data=02%7C01%7Ctschmidt%40micron.com%7C5ba545ffc6bf46e2b2a508d710a109bd%7Cf38a5ecd28134862b11bac1d563c806f%7C0%7C0%7C636996156155520395&sdata=Hdf4nWPmhqYAeZ7KL%2BB3ihwdbd%2FY2ZaA9tmYgY9PjE8%3D&reserved=0

Tom, Oh, did your patch to do_temperature.c get removed in r8050. Looks like it might have done, but it's not obvious why.

Kind regards,

SebA

On Fri, 2 Aug 2019 at 11:21, SebA <spah at syntec.co.uk> wrote:

I'm not going to make any judgement on the merit of your patches, Tom, but I did discover that you tried to get some of them merged some years ago and Henrik rejected (some of) them: https://lists.xymon.com/archive/2013-July/037941.html However, he did say he merged one of the ones you're resubmitting, so either it didn't actually get merged, or there's an issue with your e-mail and/or patch. From that e-mail in 2013:

• OK, applied.

...

• ./xymond/rrd/do_temperature.c *>* Strip leading bold and italic HTML tags from sensor names (seen *>* on *>* yellow and red alerts from BB tests)

---

I couldn't find any response from you to Henrik, but maybe it was private or not in the following 2 months.

Kind regards,

SebA

On Thu, 1 Aug 2019 at 22:30, Tom Schmidt (tschmidt) <tschmidt at micron.com> wrote:

...

Japheth and Xymon 4.3.29 users, Attached is a context diff patch file for the Xymon 4.3.29 release to address the following issues:

Bug Fixes:

• build/Makefile.Linux Use tirpc replacement only on glibc 2.26 and later. This fixes compiling and RPC issues on RHEL6 and RHEL7 platforms.

• lib/*.c files and xymonnet/xymonnet.c: Only use the "#pragma GCC diagnostic" options on gcc 4.5 and later. This fixes compiling on RHEL6.

Enhancements:

• web/showgraph.c: Change underscore to space as this is a common mangling on temperature and lic backends

• xymond/etcfiles/graphs.cfg and xymond/rrd/do_disk.c: Change disk sizes from KB to auto-scaling (i.e. GB, TB) Add FlexLM license graph for lic backend.

• xymond/rrd/do_temperature.c:

  • Strip off any bold and italic HTML tags on temperature sensor name

Thank you again for maintaining Xymon once again. Please include my recommend patches so the it compiles on RHEL6/7 platforms without issue.

Tom Schmidt Sr Manager, IT, Product Engineering IT ETD Eng Sites US Micron Technology, Inc. Office: +1 (208) 368-4058 Fax: (208)368-2807 Email: tschmidt at micron.com Website: micron.com Micron Technology, Inc., Confidential and Proprietary.

-----Original Message----- From: Xymon <xymon-bounces at xymon.com> On Behalf Of Japheth Cleaver Sent: Wednesday, July 24, 2019 7:40 PM To: Stephen Carville (xymon list) <scarville at lereta.com>; xymon at xymon.com Subject: [EXT] Re: [Xymon] Xymon 4.3.29 Released - Important Security Update

On 7/24/2019 7:01 AM, Stephen Carville (xymon list) wrote:

...

On 7/23/19 9:08 AM, Japheth Cleaver wrote:

...

Lereta Email Checkpoint: External email. Please make sure you trust this source before clicking links or opening attachments.

---

Just an FYI. When I updated my CentOS 7 xymon server by building from source, it refused to include the openssl libraries until I installed the libtirpc-devel package. Not sure why it is necessary.

Thanks, I'll make a note of that on the RPM site. The underlying reason here is that GCC's rpc interface was removed after a long deprecation, in favor of libtirpc. It was easier to simply test for that and move forward on use. This will also be necessary for 4.4 (IPv6) and was the main cause of the recent Fedora FTBFS's.

https://nam01.safelinks.protection.outlook.com/?url=https%3A%2F%2Ffedoraproject.org%2Fwiki%2FChanges%2FSunRPCRemoval&data=02%7C01%7Ctschmidt%40micron.com%7C5ba545ffc6bf46e2b2a508d710a109bd%7Cf38a5ecd28134862b11bac1d563c806f%7C0%7C0%7C636996156155520395&sdata=piP%2FSxXJ6rgvDb4Bea6PRKuxHE%2BPlAfvLehL0xGkZSw%3D&reserved=0

Regards, -jc

---

Xymon mailing list Xymon at xymon.com

https://nam01.safelinks.protection.outlook.com/?url=http%3A%2F%2Flists.xymon.com%2Fmailman%2Flistinfo%2Fxymon&data=02%7C01%7Ctschmidt%40micron.com%7C5ba545ffc6bf46e2b2a508d710a109bd%7Cf38a5ecd28134862b11bac1d563c806f%7C0%7C0%7C636996156155520395&sdata=Hdf4nWPmhqYAeZ7KL%2BB3ihwdbd%2FY2ZaA9tmYgY9PjE8%3D&reserved=0

---

Xymon mailing list Xymon at xymon.com http://lists.xymon.com/mailman/listinfo/xymon

The Terabithia Xymon 4.3.29-1 packages have been updated in the production repositories and should be available for download at https://terabithia.org/rpms/xymon/

As a reminder, EL3 and EL4 and Fedora 18-27 have been retired -- those repos have been moved to the /retired/ directory.

As EPEL8 has not yet been released, an fping package is available in the EL8 repository, as well as man2html (needed for rebuilds).

Regards, -jc

On 7/23/2019 9:08 AM, Japheth Cleaver wrote:

The RPMs available at Terabithia have been updated to 4.3.29-1 in the /testing/ repositories at the moment.

If no specific issues are found (please report!), I'll promote these into the production repo in a day or two. (An announcement will be made here.)

Please note that I've built these only for EL5/6/7/8 and F28+ at the moment. If there are requests for older RPM distributions, I can spin RPMs for them as well, but I'd like to begin pruning them a bit if they're not necessary.

Regards, -jc

On 7/23/2019 8:57 AM, Japheth Cleaver wrote:

...

Hello all,

Xymon 4.3.29 has been released to Sourceforge and should be propagating to mirrors as I write this. Along with an assortment of bug fixes and compilation compatibility fixes for recent glibc systems, this version contains several fixes for security vulnerabilities within some CGI parsing. Although some of these overflows are not exploitable, others, including an XSS vulnerability are. Fixes beyond these CVEs have been made throughout the library, web, and network code to help reduce the likelihood of similar issues in other areas. As a result, all users are encouraged to upgrade.

The specific CVEs in question are: ? CVE-2019-13451, CVE-2019-13452, CVE-2019-13455, CVE-2019-13473, ? CVE-2019-13474, CVE-2019-13484, CVE-2019-13485, CVE-2019-13486

Henrik and I would like to extend our thanks to the University of Cambridge Computer Security Incident Response Team, which reported the issues and helped validate their resolution.

Full release notes and other changes are available with the released tarball at https://sourceforge.net/projects/xymon/files/Xymon/4.3.29/

As always, thank you to everyone who has contributed patches, ideas, code, and feature requests to the project!

Sincerely, Japheth "J.C." Cleaver

On 8/5/2019 6:19 AM, Dirk Kastens wrote:

Hi,

I just upgraded our xymon server on Scientific Linux release 6.10 frpm xymon 4.3.28 to 4.3.29.

Two things are not working any longer:

http authentication: I defined the login information in the file /etc/xymon/netrc, which worked before the upgrade. Now the http test are red with the message "Authorization Required".

history files cannot be opened any more. When I click on the history button of a test, I get an empty page with the message "Cannot open history file"

Thanks,

For HTTP authentication, this is simple basic auth and not certificate-based or anything else?

For history file checking, can you verify that hosts with dashes in the name show this symptom while those with just alphanumerics (and periods) don't? I believe this may actually be the bug cause here.

-jc

On Mon, 2019-08-05 at 07:52 -0700, Japheth Cleaver wrote:

On 8/5/2019 6:19 AM, Dirk Kastens wrote:

...

Hi,

I just upgraded our xymon server on Scientific Linux release 6.10 frpm xymon 4.3.28 to 4.3.29.

Two things are not working any longer:

http authentication: I defined the login information in the file /etc/xymon/netrc, which worked before the upgrade. Now the http test are red with the message "Authorization Required".

history files cannot be opened any more. When I click on the history button of a test, I get an empty page with the message "Cannot open history file"

Thanks,

...

For history file checking, can you verify that hosts with dashes in the name show this symptom while those with just alphanumerics (and periods) don't? I believe this may actually be the bug cause here.

Interesting. Can confirm that our clients without a hyphen/dash in the name work fine with history. The hosts with a hyphen/dash do not - they get a "Cannot open history file" error.

John.

-- John Horne | Senior Operations Analyst | Technology and Information Services University of Plymouth | Drake Circus | Plymouth | Devon | PL4 8AA | UK

[http://www.plymouth.ac.uk/images/email_footer.gif]<http://www.plymouth.ac.uk/worldclass>

This email and any files with it are confidential and intended solely for the use of the recipient to whom it is addressed. If you are not the intended recipient then copying, distribution or other use of the information contained is strictly prohibited and you should not rely on it. If you have received this email in error please let the sender know immediately and delete it from your system(s). Internet emails are not necessarily secure. While we take every care, University of Plymouth accepts no responsibility for viruses and it is your responsibility to scan emails and their attachments. University of Plymouth does not accept responsibility for any changes made after it was sent. Nothing in this email or its attachments constitutes an order for goods or services unless accompanied by an official order form.

I likewise see that history button issue for hostnames with dashes or underscores. Attached is a context diff patch file to fix the issue. Are there other alphanumerics in hostnames that should be added to line 608 of the web/history.c file?

Tom Schmidt Sr Manager, IT, Product Engineering IT ETD Eng Sites US Micron Technology, Inc. Office:?+1 (208) 368-4058 ?Fax:?(208)368-2807 Email:?tschmidt at micron.com? Website:?micron.com Micron Technology, Inc., Confidential and Proprietary.

-----Original Message----- From: Xymon <xymon-bounces at xymon.com> On Behalf Of Richard L. Hamilton Sent: Monday, August 5, 2019 10:53 AM To: xymon at xymon.com Subject: [EXT] Re: [Xymon] Xymon 4.3.29 Released - Important Security Update

Yes, I'm seeing the dash problem too. Some of my VMs have dashes in the name (since they don't migrate, it makes it easier to remember which host they're on); most don't run all the time ("dialup" if you will), but one (actually a Solaris zone) does. All the ones with dashes in the name get "Cannot open history file". Please fix!!!

On Aug 5, 2019, at 11:51, John Horne <john.horne at plymouth.ac.uk> wrote:

On Mon, 2019-08-05 at 07:52 -0700, Japheth Cleaver wrote:

...

On 8/5/2019 6:19 AM, Dirk Kastens wrote:

...

Hi,

I just upgraded our xymon server on Scientific Linux release 6.10 frpm xymon 4.3.28 to 4.3.29.

Two things are not working any longer:

http authentication: I defined the login information in the file /etc/xymon/netrc, which worked before the upgrade. Now the http test are red with the message "Authorization Required".

history files cannot be opened any more. When I click on the history button of a test, I get an empty page with the message "Cannot open history file"

Thanks,

...

...

For history file checking, can you verify that hosts with dashes in the name show this symptom while those with just alphanumerics (and periods) don't? I believe this may actually be the bug cause here.

Interesting. Can confirm that our clients without a hyphen/dash in the name work fine with history. The hosts with a hyphen/dash do not - they get a "Cannot open history file" error.

John.

-- John Horne | Senior Operations Analyst | Technology and Information Services University of Plymouth | Drake Circus | Plymouth | Devon | PL4 8AA | UK ________________________________ [https://nam01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww. plymouth.ac.uk%2Fimages%2Femail_footer.gif&data=02%7C01%7Ctschmidt %40micron.com%7Cad7b0f57ffe848cc8adf08d719c564d8%7Cf38a5ecd28134862b11 bac1d563c806f%7C0%7C0%7C637006207919043258&sdata=PU9uQpCzE4ncJnmC9 GDVRFV7n9silwy1FQP3IyCYMNk%3D&reserved=0]<https://nam01.safelinks. protection.outlook.com/?url=http%3A%2F%2Fwww.plymouth.ac.uk%2Fworldcla ss&data=02%7C01%7Ctschmidt%40micron.com%7Cad7b0f57ffe848cc8adf08d7 19c564d8%7Cf38a5ecd28134862b11bac1d563c806f%7C0%7C0%7C6370062079190432 58&sdata=%2BkT7Ki%2FfHy2o96Tf2Z483xvGh2UUxEauM%2BJHcv5uK0k%3D& reserved=0>

This email and any files with it are confidential and intended solely for the use of the recipient to whom it is addressed. If you are not the intended recipient then copying, distribution or other use of the information contained is strictly prohibited and you should not rely on it. If you have received this email in error please let the sender know immediately and delete it from your system(s). Internet emails are not necessarily secure. While we take every care, University of Plymouth accepts no responsibility for viruses and it is your responsibility to scan emails and their attachments. University of Plymouth does not accept responsibility for any changes made after it was sent. Nothing in this email or its attachments constitutes an order for goods or services unless accompanied by an official order form.

---

Xymon mailing list Xymon at xymon.com https://nam01.safelinks.protection.outlook.com/?url=http%3A%2F%2Flists .xymon.com%2Fmailman%2Flistinfo%2Fxymon&data=02%7C01%7Ctschmidt%40 micron.com%7Cad7b0f57ffe848cc8adf08d719c564d8%7Cf38a5ecd28134862b11bac 1d563c806f%7C0%7C0%7C637006207919043258&sdata=0jIe1wKKWphh7%2FFhir dYAB8Z8A4Qwbr%2BKIKcOdV5kMA%3D&reserved=0

Xymon mailing list Xymon at xymon.com https://nam01.safelinks.protection.outlook.com/?url=http%3A%2F%2Flists.xymon.com%2Fmailman%2Flistinfo%2Fxymon&data=02%7C01%7Ctschmidt%40micron.com%7Cad7b0f57ffe848cc8adf08d719c564d8%7Cf38a5ecd28134862b11bac1d563c806f%7C0%7C0%7C637006207919043258&sdata=0jIe1wKKWphh7%2FFhirdYAB8Z8A4Qwbr%2BKIKcOdV5kMA%3D&reserved=0

I had a similar issue with the HTTPS test. I found specifying the Xymon server's IP during the configure script caused the problem. The OpenSSL info didn't show up on the xymonnet page. Rerunning configure, leaving 127.0.0.1 for the IP, rebuilding, and reinstalling fixed it.

I still had other issues so I reverted my test server back to 4.3.28 since I was leaving for vacation.

Running on Oracle Linux 6.x, used the patches available thru last Friday but don't recall if libtirpc-devel is installed.

On Fri, Aug 9, 2019, 12:15 AM Bruce Ferrell <bferrell at baywinds.org> wrote:

I did the same thing and did it from source.

After removing the #pragma statements and adding libtirpc-devel to get it to compile, I found the https sites failed. They do pass the sslcert test.

I just rolled back to 4.3.28

I'll figure it out later, after I figure out how the rollback screwed up the built in SNMP support that I so painfully got working and was still documenting.

sigh

On 8/5/19 6:19 AM, Dirk Kastens wrote:

...

Hi,

I just upgraded our xymon server on Scientific Linux release 6.10 frpm xymon 4.3.28 to 4.3.29.

Two things are not working any longer:

http authentication: I defined the login information in the file /etc/xymon/netrc, which worked before the upgrade. Now the http test are red with the message "Authorization Required".

history files cannot be opened any more. When I click on the history button of a test, I get an empty page with the message "Cannot open history file"

Am 29.07.2019 um 19:41 schrieb Japheth Cleaver:

...

The Terabithia Xymon 4.3.29-1 packages have been updated in the production repositories and should be available for download at https://terabithia.org/rpms/xymon/

As a reminder, EL3 and EL4 and Fedora 18-27 have been retired -- those repos have been moved to the /retired/ directory.

As EPEL8 has not yet been released, an fping package is available in the EL8 repository, as well as man2html (needed for rebuilds).

---

Xymon mailing list Xymon at xymon.com http://lists.xymon.com/mailman/listinfo/xymon

---

Xymon mailing list Xymon at xymon.com http://lists.xymon.com/mailman/listinfo/xymon

Richard: Can you provide the output of --debug on a xymonnet run off-list? This could be a parsing issue somewhere, but from glancing at the code I'm not sure where the logic might be diverging.

Robert:

So far I haven't been able to duplicate this one. Do you happen to have ./configure output in scrollback? While an IP that doesn't match hostname or isn't up *could* affect something, the compilation check for SSL support seems totally distinct. Were other SSL tests also failing? Alternatively, is there a chance the SSL versioning/cypher lockdown might be different on this endpoint?

-jc

On 8/9/2019 7:47 AM, Richard L. Hamilton wrote:

I think I had to add login and password to the URL for an http test (to something that required those), where previously an entry in $HOME/server/etc/netrc sufficed. ?In other words, the behavior changed with the update.

...

On Aug 9, 2019, at 09:23, Robert Herron <robert.herron at gmail.com <mailto:robert.herron at gmail.com>> wrote:

I had a similar issue with the HTTPS test. I found specifying the Xymon server's IP during the configure script caused the problem. The OpenSSL info didn't show up on the xymonnet page.? Rerunning configure, leaving 127.0.0.1 for the IP, rebuilding, and reinstalling fixed it.

I still had other issues so I reverted my test server back to 4.3.28 since I was leaving for vacation.

Running on Oracle Linux 6.x, used the patches available thru last Friday but don't recall if libtirpc-devel is installed.

On Fri, Aug 9, 2019, 12:15 AM Bruce Ferrell <bferrell at baywinds.org <mailto:bferrell at baywinds.org>> wrote:

I did the same thing and did it from source.

After removing the #pragma statements and adding libtirpc-devel
to get it to compile, I found the https sites failed.? They do
pass the sslcert test.

I just rolled back to 4.3.28

I'll figure it out later, after I figure out how the rollback
screwed up the built in SNMP support that I so painfully got
working and was still documenting.

sigh



On 8/5/19 6:19 AM, Dirk Kastens wrote:
> Hi,
>
> I just upgraded our xymon server on Scientific Linux release
6.10 frpm xymon 4.3.28 to 4.3.29.
>
> Two things are not working any longer:
>
> http authentication: I defined the login information in the
file /etc/xymon/netrc, which worked before the upgrade. Now the
http test are red with the message "Authorization
> Required".
>
> history files cannot be opened any more. When I click on the
history button of a test, I get an empty page with the message
"Cannot open history file"
>
> Am 29.07.2019 um 19:41 schrieb Japheth Cleaver:
>> The Terabithia Xymon 4.3.29-1 packages have been updated in
the production repositories and should be available for download
at https://terabithia.org/rpms/xymon/
>>
>> As a reminder, EL3 and EL4 and Fedora 18-27 have been retired
-- those repos have been moved to the /retired/ directory.
>>
>> As EPEL8 has not yet been released, an fping package is
available in the EL8 repository, as well as man2html (needed for
rebuilds).
>
>

Probably also in all the following: -bash-4.1$ find . -type f -exec grep pragma {} + ./xymonnet/xymonnet.c: #pragma GCC diagnostic push ./xymonnet/xymonnet.c: #pragma GCC diagnostic ignored "-Wformat-truncation" ./xymonnet/xymonnet.c: #pragma GCC diagnostic pop ./lib/holidays.c: #pragma GCC diagnostic push ./lib/holidays.c: #pragma GCC diagnostic ignored "-Wformat-truncation" ./lib/holidays.c: #pragma GCC diagnostic pop ./lib/acklog.c: #pragma GCC diagnostic push ./lib/acklog.c: #pragma GCC diagnostic ignored "-Wformat-truncation" ./lib/acklog.c: #pragma GCC diagnostic pop ./lib/tree.c:#pragma GCC diagnostic push ./lib/tree.c:#pragma GCC diagnostic ignored "-Wunused-result" ./lib/tree.c:#pragma GCC diagnostic pop ./lib/htmllog.c: #pragma GCC diagnostic push ./lib/htmllog.c: #pragma GCC diagnostic ignored "-Wformat-truncation" ./lib/htmllog.c: #pragma GCC diagnostic pop ./lib/stackio.c: #pragma GCC diagnostic push ./lib/stackio.c: #pragma GCC diagnostic ignored "-Wformat-truncation" ./lib/stackio.c: #pragma GCC diagnostic pop ./lib/timefunc.c: #pragma GCC diagnostic push ./lib/timefunc.c: #pragma GCC diagnostic ignored "-Wformat-truncation" ./lib/timefunc.c: #pragma GCC diagnostic pop ./lib/misc.c: #pragma GCC diagnostic push ./lib/misc.c: #pragma GCC diagnostic ignored "-Wformat-truncation" ./lib/misc.c: #pragma GCC diagnostic pop ./lib/eventlog.c: #pragma GCC diagnostic push ./lib/eventlog.c: #pragma GCC diagnostic ignored "-Wformat-truncation" ./lib/eventlog.c: #pragma GCC diagnostic pop

On Jul 24, 2019, at 08:46, Richard L. Hamilton <rlhamil2 at gmail.com> wrote:

gcc prior to 4.6 gives the errors:

acklog.c: In function ?do_acklog?: acklog.c:129:12: error: #pragma GCC diagnostic not allowed inside functions acklog.c:130:12: error: #pragma GCC diagnostic not allowed inside functions acklog.c:132:12: error: #pragma GCC diagnostic not allowed inside functions

Discussion of other software with a similar problem suggests a gcc version test for those. Or just comment out those lines, for those who don't want to install a newer gcc and don't want to wait for a version test to be added.

...

On Jul 23, 2019, at 12:11, Japheth Cleaver <cleaver at terabithia.org> wrote:

On 7/23/2019 8:57 AM, Japheth Cleaver wrote:

...

Hello all,

Xymon 4.3.29 has been released to Sourceforge and should be propagating to mirrors as I write this. Along with an assortment of bug fixes and compilation compatibility fixes for recent glibc systems, this version contains several fixes for security vulnerabilities within some CGI parsing. Although some of these overflows are not exploitable, others, including an XSS vulnerability are. Fixes beyond these CVEs have been made throughout the library, web, and network code to help reduce the likelihood of similar issues in other areas. As a result, all users are encouraged to upgrade.

The specific CVEs in question are: CVE-2019-13451, CVE-2019-13452, CVE-2019-13455, CVE-2019-13473, CVE-2019-13474, CVE-2019-13484, CVE-2019-13485, CVE-2019-13486

For clarification, the above CVEs only affect the *server* side of the Xymon monitoring system. Xymon clients are not affected.

-jc

---

Xymon mailing list Xymon at xymon.com http://lists.xymon.com/mailman/listinfo/xymon

On 7/24/2019 6:54 AM, Axel Beckert wrote:

Hi,

On Tue, Jul 23, 2019 at 08:57:49AM -0700, Japheth Cleaver wrote:

...

Although some of these overflows are not exploitable, others, including an XSS vulnerability are. [... ? CVE-2019-13451, CVE-2019-13452, CVE-2019-13455, CVE-2019-13473, ? CVE-2019-13474, CVE-2019-13484, CVE-2019-13485, CVE-2019-13486 Can either you or Graham get a bit more into the details regarding the impact of any of these vulnerabilities ? or point out a posting where they are explained in more detail? So far I wasn't able to dig up any posting or similar, e.g. by the Cambridge CSIRT or Graham.

Currently the severity as well as the actual impact of these issues is quite unclear ? also because the CVE-IDs all still say "RESERVED".

  Regards, Axel

CSIRT may still have a write-up pending on these, but it is believed that the only impact are segfaults when passed in invalid/overflow input. This is typically a hostsvc being parsed and assigned to a PATH_MAX-sized variable via sprintf rather than snprintf. The buffer overflow occurs, but it is not being passed unprocessed to a shell. In some cases passed parameters are passed through html quoting, thereby exceeding intended size through " " -> " " inflation, which leads to a buffer overflow when (unsafely) assigning to error output.

There was an initial concern about unparsed input being handed to xymongen during report generation, however this is passed as a single execv argument rather than via shell processing. This could lead to erroneous xymongen resource use by anyone with access to /xymon-seccgi/report.sh, however the same could be said for any (legitimate) access here.

The XSS (CVE-2019-13274) is trivially exploitable by attempting to pass javascript through the db parameter to csvinfo.sh.

Beyond the CVE's, we wanted to try to remove a large number of sprintf uses (especially in the web and lib code) to help potentially reduce future issues.

Regards, -jc