Opsview Monitor up to 5.3.0/5.4.1 opsview-reporting-module access control

Summaryinfo

A vulnerability marked as critical has been reported in Opsview Monitor up to 5.3.0/5.4.1. Affected is an unknown function of the file /etc/init.d/opsview-reporting-module. The manipulation leads to access control. This vulnerability is uniquely identified as CVE-2018-16145. The attack is possible to be carried out remotely. No exploit exists. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as very critical, has been found in Opsview Monitor up to 5.3.0/5.4.1. This issue affects an unknown code of the file /etc/init.d/opsview-reporting-module. The manipulation with an unknown input leads to a access control vulnerability. Using CWE to declare the problem leads to CWE-264. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

The /etc/init.d/opsview-reporting-module script that runs at boot time in Opsview Monitor before 5.3.1 and 5.4.x before 5.4.2 invokes a file that can be edited by the nagios user, and would allow attackers to elevate their privileges to root after a system restart, hence obtaining full control of the appliance.

The bug was discovered 09/04/2018. The weakness was disclosed 09/05/2018 as not defined mailinglist post (Full-Disclosure). The advisory is shared at seclists.org. The identification of this vulnerability is CVE-2018-16145 since 08/29/2018. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 03/20/2020). MITRE ATT&CK project uses the attack technique T1068 for this issue.

The vulnerability was handled as a non-public zero-day exploit for at least 1 days. During that time the estimated underground price was around $0-$5k. The commercial vulnerability scanner Qualys is able to test this issue with plugin 13278 (Opsview Monitor Multiple Vulnerabilities).

Upgrading to version 5.3.1 or 5.4.2 eliminates this vulnerability.

The entries VDB-121379, VDB-121380, VDB-121381 and VDB-123616 are pretty similar. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• Opsview

Name

• Monitor

Version

• 5.0
• 5.1
• 5.2
• 5.3.0
• 5.4.0
• 5.4.1

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion