CVE-2017-6188

NameCVE-2017-6188
DescriptionMunin before 2.999.6 has a local file write vulnerability when CGI graphs are enabled. Setting multiple upper_limit GET parameters allows overwriting any file accessible to the www-data user.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SuSE, Mageia, GitHub code/issues, web search, more)
ReferencesDLA-836-1, DSA-3794-1
NVD severitylow (attack range: local)
Debian Bugs855705

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
munin (PTS)wheezy2.0.6-4+deb7u2vulnerable
wheezy (security)2.0.6-4+deb7u4fixed
jessie, jessie (security)2.0.25-1+deb8u3fixed
stretch2.0.33-1fixed
buster, sid2.0.34-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
muninsource(unstable)2.0.31-1low855705
muninsourcejessie2.0.25-1+deb8u1lowDSA-3794-1
muninsourcewheezy2.0.6-4+deb7u3lowDLA-836-1

Notes

https://github.com/munin-monitoring/munin/issues/721

Search for package or bug name: Reporting problems