Skip to content
Fencer Intel
medium 5.5

CVE-2013-7108 json

Multiple off-by-one errors in Nagios Core 3.5.1, 4.0.2, and earlier, and Icinga before 1.8.5, 1.9 before 1.9.4, and 1.10 before 1.10.2 allo…

published 2014-01-14 12 y ago modified 2026-06-17 4 mo ago also EUVD-2013-6894

cvss
5.5
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
61.6%
EPSS 61.6% chance of exploitation in 30 days, percentile 99.1%
public exploits
1
Exploit-DB

Summary

Multiple off-by-one errors in Nagios Core 3.5.1, 4.0.2, and earlier, and Icinga before 1.8.5, 1.9 before 1.9.4, and 1.10 before 1.10.2 allow remote authenticated users to obtain sensitive information from process memory or cause a denial of service (crash) via a long string in the last key value in the variable list to the process_cgivars function in (1) avail.c, (2) cmd.c, (3) config.c, (4) extinfo.c, (5) histogram.c, (6) notifications.c, (7) outages.c, (8) status.c, (9) statusmap.c, (10) summary.c, and (11) trends.c in cgi/, which triggers a heap-based buffer over-read.

Patch / fix

  • nagios3 Ubuntu 14.04 LTS 3.5.1-1ubuntu1.1
  • nagios3 Ubuntu 16.04 LTS 3.5.1.dfsg-2.1ubuntu1.1

ubuntu advisories UBUNTU-CVE-2013-7108

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • nagios openSUSE Tumbleweed 4.4.6-2.5

opensuse advisories openSUSE-SU-2024:11073-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2013-7108 updated cvss 4.0

nagios: denial of service due to off-by-one flaw in process_cgivars()

  • Red Hat Enterprise Linux OpenStack Platform 5 (Icehouse) nagios Red Hat Enterprise Linux OpenStack Platform 6 (Juno) nagios
    affected: no fix available “Fix deferred”
  • Red Hat OpenStack Platform 3 nagios Red Hat OpenStack Platform 4 nagios
    affected: no fix planned “Will not fix”

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

  1. First public exploit (EDB-38882)
  2. Published

Exploit prediction

61.63% chance of exploitation in the next 30 days, higher than 99.1% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • EDB-38882 Icinga - cgi/config.c process_cgivars Function Off-by-One Read Remote Denial of Service dos, 2013-12-16

CVSS scores

assigned by version score vector
NVD 2.0 5.5 AV:N/AC:L/Au:S/C:P/I:N/A:P

Classification

Weakness
  • CWE-20 Improper Input Validation

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.