Vulnerability CVE-2016-2055

Vulnerability Name:

CVE-2016-2055 (CCN-110591)

Assigned:

2016-02-14

Published:

2016-02-14

Updated:

2018-10-09

Summary:

xymond/xymond.c in xymond in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 allow remote attackers to read arbitrary files in the configuration directory via a "config" command.

CVSS v3 Severity:

7.5 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
7.0 High (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:F/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): High Integrity (I): None Availibility (A): None

5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
4.9 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:F/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): Low Integrity (I): None Availibility (A): None

CVSS v2 Severity:

5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): None Availibility (A): None

5.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): None Availibility (A): None

Vulnerability Type:

CWE-200

Vulnerability Consequences:

Obtain Information

References:

Source: MITRE
Type: CNA
CVE-2016-2055

Source: MISC
Type: UNKNOWN
http://packetstormsecurity.com/files/135758/Xymon-4.3.x-Buffer-Overflow-Code-Execution-Information-Disclosure.html

Source: CCN
Type: BugTraq Mailing List, Sun, 14 Feb 2016 11:33:28 +0100
Xymon: Critical security issues in all versions prior to 4.3.25

Source: DEBIAN
Type: UNKNOWN
DSA-3495

Source: BUGTRAQ
Type: UNKNOWN
20160214 Xymon: Critical security issues in all versions prior to 4.3.25

Source: XF
Type: UNKNOWN
xymon-cve20162055-info-disc(110591)

Source: CCN
Type: Packet Storm Security [02-15-2016]
Xymon 4.3.x Buffer Overflow / Code Execution / Information Disclosure

Source: CONFIRM
Type: Patch
https://sourceforge.net/p/xymon/code/7890/

Source: CCN
Type: Xymon Web page
Xymon 4.3.25 Released - Security update

Source: CCN
Type: Rapid7 Vulnerability and Exploit Database [08-15-2019]
Xymon Daemon Gather Information

Vulnerable Configuration:

Configuration 1:

cpe:/a:xymon:xymon:4.1.0:*:*:*:*:*:*:*

OR cpe:/a:xymon:xymon:4.1.1:*:*:*:*:*:*:*

OR cpe:/a:xymon:xymon:4.1.2:*:*:*:*:*:*:*

OR cpe:/a:xymon:xymon:4.1.2:p1:*:*:*:*:*:*

OR cpe:/a:xymon:xymon:4.1.2:p2:*:*:*:*:*:*

OR cpe:/a:xymon:xymon:4.2:alfa:*:*:*:*:*:*

OR cpe:/a:xymon:xymon:4.2:beta20060605:*:*:*:*:*:*

OR cpe:/a:xymon:xymon:4.2:rc20060712:*:*:*:*:*:*

OR cpe:/a:xymon:xymon:4.2.0:*:*:*:*:*:*:*

OR cpe:/a:xymon:xymon:4.2.2:*:*:*:*:*:*:*

OR cpe:/a:xymon:xymon:4.2.2:rc1:*:*:*:*:*:*

OR cpe:/a:xymon:xymon:4.2.3:*:*:*:*:*:*:*

OR cpe:/a:xymon:xymon:4.2.3:rc1:*:*:*:*:*:*

OR cpe:/a:xymon:xymon:4.3.0:*:*:*:*:*:*:*

OR cpe:/a:xymon:xymon:4.3.0:beta1:*:*:*:*:*:*

OR cpe:/a:xymon:xymon:4.3.0:beta2:*:*:*:*:*:*

OR cpe:/a:xymon:xymon:4.3.0:beta3:*:*:*:*:*:*

OR cpe:/a:xymon:xymon:4.3.0:rc1:*:*:*:*:*:*

OR cpe:/a:xymon:xymon:4.3.1:*:*:*:*:*:*:*

OR cpe:/a:xymon:xymon:4.3.2:*:*:*:*:*:*:*

OR cpe:/a:xymon:xymon:4.3.3:*:*:*:*:*:*:*

OR cpe:/a:xymon:xymon:4.3.4:*:*:*:*:*:*:*

OR cpe:/a:xymon:xymon:4.3.5:*:*:*:*:*:*:*

OR cpe:/a:xymon:xymon:4.3.6:*:*:*:*:*:*:*

OR cpe:/a:xymon:xymon:4.3.7:*:*:*:*:*:*:*

OR cpe:/a:xymon:xymon:4.3.8:*:*:*:*:*:*:*

OR cpe:/a:xymon:xymon:4.3.9:*:*:*:*:*:*:*

OR cpe:/a:xymon:xymon:4.3.10:*:*:*:*:*:*:*

OR cpe:/a:xymon:xymon:4.3.11:*:*:*:*:*:*:*

OR cpe:/a:xymon:xymon:4.3.12:*:*:*:*:*:*:*

OR cpe:/a:xymon:xymon:4.3.13:*:*:*:*:*:*:*

OR cpe:/a:xymon:xymon:4.3.14:*:*:*:*:*:*:*

OR cpe:/a:xymon:xymon:4.3.15:*:*:*:*:*:*:*

OR cpe:/a:xymon:xymon:4.3.16:*:*:*:*:*:*:*

OR cpe:/a:xymon:xymon:4.3.17:*:*:*:*:*:*:*

OR cpe:/a:xymon:xymon:4.3.18:*:*:*:*:*:*:*

OR cpe:/a:xymon:xymon:4.3.19:*:*:*:*:*:*:*

OR cpe:/a:xymon:xymon:4.3.19:rc1:*:*:*:*:*:*

OR cpe:/a:xymon:xymon:4.3.20:*:*:*:*:*:*:*

OR cpe:/a:xymon:xymon:4.3.21:*:*:*:*:*:*:*

OR cpe:/a:xymon:xymon:4.3.22:*:*:*:*:*:*:*

OR cpe:/a:xymon:xymon:4.3.23:*:*:*:*:*:*:*

OR cpe:/a:xymon:xymon:4.3.24:*:*:*:*:*:*:*

Configuration 2:

cpe:/o:debian:debian_linux:8.0:*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/a:xymon:xymon:4.3.24:*:*:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:com.ubuntu.bionic:def:201620550000000	V	CVE-2016-2055 on Ubuntu 18.04 LTS (bionic) - medium.	2016-04-13
oval:com.ubuntu.artful:def:20162055000	V	CVE-2016-2055 on Ubuntu 17.10 (artful) - medium.	2016-04-13
oval:com.ubuntu.trusty:def:20162055000	V	CVE-2016-2055 on Ubuntu 14.04 LTS (trusty) - medium.	2016-04-13
oval:com.ubuntu.xenial:def:201620550000000	V	CVE-2016-2055 on Ubuntu 16.04 LTS (xenial) - medium.	2016-04-13
oval:com.ubuntu.bionic:def:20162055000	V	CVE-2016-2055 on Ubuntu 18.04 LTS (bionic) - medium.	2016-04-13
oval:com.ubuntu.xenial:def:20162055000	V	CVE-2016-2055 on Ubuntu 16.04 LTS (xenial) - medium.	2016-04-13
oval:com.ubuntu.disco:def:201620550000000	V	CVE-2016-2055 on Ubuntu 19.04 (disco) - medium.	2016-04-13
oval:com.ubuntu.cosmic:def:20162055000	V	CVE-2016-2055 on Ubuntu 18.10 (cosmic) - medium.	2016-04-13
oval:com.ubuntu.cosmic:def:201620550000000	V	CVE-2016-2055 on Ubuntu 18.10 (cosmic) - medium.	2016-04-13
oval:com.ubuntu.precise:def:20162055000	V	CVE-2016-2055 on Ubuntu 12.04 LTS (precise) - medium.	2016-04-13

BACK