A vulnerability was found in Icinga up to 2.8.1. It has been rated as problematic. Affected by this issue is an unknown functionality. The manipulation as part of a Request leads to a resource consumption vulnerability. Using CWE to declare the problem leads to CWE-400. The software does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. Impacted is availability. CVE summarizes:

An issue was discovered in Icinga 2.x through 2.8.1. By sending specially crafted (authenticated and unauthenticated) requests, an attacker can exhaust a lot of memory on the server side, triggering the OOM killer.

The weakness was disclosed 02/27/2018 (GitHub Repository). The advisory is shared for download at github.com. This vulnerability is handled as CVE-2018-6532 since 02/02/2018. The attack may be launched remotely. No form of authentication is required for exploitation. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1499.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The entries 113915, 113914 and 113913 are pretty similar.

Productinfo

Name

• Icinga

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion