{"id":"CVE-2013-7205","aliases":["DLA-1615-1","EUVD-2013-6988","GHSA-m23h-2mvj-h557","MGASA-2014-0010","UBUNTU-CVE-2013-7205","USN-3253-1"],"status":"published","title":"Off-by-one error in the process_cgivars function in contrib/daemonchk.c in Nagios Core 3.5.1, 4.0...","description":"Off-by-one error in the process_cgivars function in contrib/daemonchk.c in Nagios Core 3.5.1, 4.0.2, and earlier allows remote authenticated users to obtain sensitive information from process memory or cause a denial of service (crash) via a long string in the last key value in the variable list, which triggers a heap-based buffer over-read.","severity":{"version":"2.0","score":6.4,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.04597,"percentile":0.9171,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119"],"published":"2014-01-14T18:00:00Z","modified":"2026-06-17T00:01:31Z","fixes":[{"ecosystem":"Ubuntu:14.04:LTS","package":"nagios3","fixed_in":["3.5.1-1ubuntu1.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"nagios3","fixed_in":["3.5.1.dfsg-2.1ubuntu1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:8","package":"nagios3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1.dfsg-2+deb8u1"}]}],"versions":["3.5.1.dfsg-2"],"bundled":5},{"source":"osv","ecosystem":"Mageia:3","package":"nagios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.4-4.2.mga3"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"nagios3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1-1ubuntu1.1"}]}],"versions":["3.4.1-5ubuntu2","3.4.1-5ubuntu3","3.5.1-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"nagios3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1.dfsg-2.1ubuntu1.1"}]}],"versions":["3.5.1-1ubuntu4","3.5.1.dfsg-2ubuntu1","3.5.1.dfsg-2ubuntu2","3.5.1.dfsg-2.1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"nagios3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1-1ubuntu1.1"}]}],"versions":["3.4.1-5ubuntu2","3.4.1-5ubuntu3","3.5.1-1ubuntu1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"nagios3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1.dfsg-2.1ubuntu1.1"}]}],"versions":["3.5.1-1ubuntu4","3.5.1.dfsg-2ubuntu1","3.5.1.dfsg-2ubuntu2","3.5.1.dfsg-2.1ubuntu1"],"bundled":4}],"products":[{"vendor":"nagios","product":"nagios"}],"references":[{"url":"http://www.securityfocus.com/bid/64489","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2014:004","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred"]},{"url":"http://sourceforge.net/p/nagios/nagioscore/ci/d97e03f32741a7d851826b03ed73ff4c9612a866/","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/12/msg00014.html","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2013/12/24/1","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"http://secunia.com/advisories/55976","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-7205"},{"url":"http://sourceforge.net/p/nagios/nagioscore/ci/d97e03f32741a7d851826b03ed73ff4c9612a866"},{"url":"https://github.com/advisories/GHSA-m23h-2mvj-h557"},{"url":"https://advisories.mageia.org/MGASA-2014-0010.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=12100","tags":["report"]},{"url":"https://secunia.com/advisories/55976/","tags":["advisory"]},{"url":"http://openwall.com/lists/oss-security/2013/12/24/1","tags":["web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1046113","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2013-7205","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3253-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-7205","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2013-7108","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-1878","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-9566","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2013-7205","description":"Off-by-one error in the process_cgivars function in contrib/daemonchk.c in Nagios Core 3.5.1, 4.0.2, and earlier allows remote authenticated users to obtain sensitive information from process memory or cause a denial of service (crash) via a long string in the last key value in the variable list, which triggers a heap-based buffer over-read.","status":"published","published":"2014-01-14T18:00:00Z","modified":"2024-08-06T18:01:20.131Z","updated_at":"2026-11-02T14:34:58.882751Z"}],"euvd":[{"id":"EUVD-2013-6988","description":"Off-by-one error in the process_cgivars function in contrib/daemonchk.c in Nagios Core 3.5.1, 4.0.2, and earlier allows remote authenticated users to obtain sensitive information from process memory or cause a denial of service (crash) via a long string in the last key value in the variable list, which triggers a heap-based buffer over-read.","status":"published","published":"2014-01-14T18:00:00Z","modified":"2024-08-06T18:01:20Z","updated_at":"2026-11-03T01:56:23.942036Z"}],"ghsa":[{"id":"GHSA-m23h-2mvj-h557","title":"Off-by-one error in the process_cgivars function in contrib/daemonchk.c in Nagios Core 3.5.1, 4.0...","description":"Off-by-one error in the process_cgivars function in contrib/daemonchk.c in Nagios Core 3.5.1, 4.0.2, and earlier allows remote authenticated users to obtain sensitive information from process memory or cause a denial of service (crash) via a long string in the last key value in the variable list, which triggers a heap-based buffer over-read.","status":"published","published":"2022-05-14T01:45:49Z","modified":"2025-04-11T04:18:55Z","cwes":["CWE-119"],"updated_at":"2026-11-02T15:01:15.391359Z"}],"nvd":[{"id":"CVE-2013-7205","description":"Off-by-one error in the process_cgivars function in contrib/daemonchk.c in Nagios Core 3.5.1, 4.0.2, and earlier allows remote authenticated users to obtain sensitive information from process memory or cause a denial of service (crash) via a long string in the last key value in the variable list, which triggers a heap-based buffer over-read.","status":"published","published":"2014-01-15T16:08:04.063Z","modified":"2026-06-17T00:01:31.997Z","cvss":[{"version":"2.0","score":6.4,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:02:48.062712Z"}],"osv":[{"id":"DLA-1615-1","title":"nagios3 - security update","status":"published","published":"2018-12-24T00:00:00Z","modified":"2026-03-09T01:18:24.058758Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"MGASA-2014-0010","title":"Updated nagios package fixes security vulnerability","description":"A flaw was reported and fixed in Nagios, which can be exploited to cause a\ndenial of service.  This vulnerability is caused due to an off-by-one\nerror within the process_cgivars() function, which can be exploited to\ncause an out-of-bounds read by sending a specially-crafted key value to the Nagios\nweb UI (CVE-2013-7108, CVE-2013-7205).\nAn issue that prevented the service from starting has also been fixed.\n","status":"published","published":"2014-01-17T00:22:05Z","modified":"2026-04-16T06:23:27.322468609Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"UBUNTU-CVE-2013-7205","description":"Off-by-one error in the process_cgivars function in contrib/daemonchk.c in Nagios Core 3.5.1, 4.0.2, and earlier allows remote authenticated users to obtain sensitive information from process memory or cause a denial of service (crash) via a long string in the last key value in the variable list, which triggers a heap-based buffer over-read.","status":"published","published":"2014-01-15T00:00:00Z","modified":"2026-02-04T02:30:42.835388Z","updated_at":"2026-11-02T15:54:07.421078Z"},{"id":"USN-3253-1","title":"nagios3 vulnerabilities","description":"It was discovered that Nagios incorrectly handled certain long strings. A\nremote authenticated attacker could use this issue to cause Nagios to\ncrash, resulting in a denial of service, or possibly obtain sensitive\ninformation. (CVE-2013-7108, CVE-2013-7205)\n\nIt was discovered that Nagios incorrectly handled certain long messages to\ncmd.cgi. A remote attacker could possibly use this issue to cause Nagios to\ncrash, resulting in a denial of service. (CVE-2014-1878)\n\nDawid Golunski discovered that Nagios incorrectly handled symlinks when\naccessing log files. A local attacker could possibly use this issue to\nelevate privileges. In the default installation of Ubuntu, this should be\nprevented by the Yama link restrictions. (CVE-2016-9566)\n","status":"published","published":"2017-04-03T17:42:28Z","modified":"2026-02-10T04:41:06Z","updated_at":"2026-11-02T16:58:10.303275Z"}]}}