CVE-2018-6533

NameCVE-2018-6533
DescriptionAn issue was discovered in Icinga 2.x through 2.8.1. By editing the init.conf file, Icinga 2 can be run as root. Following this the program can be used to run arbitrary code as root. This was fixed by no longer using init.conf to determine account information for any root-executed code (a larger issue than CVE-2017-16933).
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severityhigh (attack range: local)
Debian Bugs897301

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
icinga2 (PTS)jessie2.1.1-1vulnerable
stretch2.6.0-2vulnerable
buster, sid2.10.2-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
icinga2source(unstable)2.8.4-1low897301

Notes

[stretch] - icinga2 <no-dsa> (Minor issue)
[jessie] - icinga2 <no-dsa> (Minor issue)
https://github.com/Icinga/icinga2/pull/5850
CVE is related to CVE-2017-16933 but for "the issue in using
init.conf to support run-time reconfiguration of an account is
design flaw". CVE-2018-6533 larger issue than CVE-2017-16933.

Search for package or bug name: Reporting problems