Monitoring Plugins
Monthly
Heap memory corruption in the check_icmp plugin shipped with Monitoring Plugins 3.0.0-rc1 through 3.0.0 gives a local low-privileged user an out-of-bounds write inside a process that still holds root privileges when check_icmp is installed setuid-root. Passing more than 65,535 hosts, either as repeated -H/--Host arguments or as Host= entries in an --extra-opts ini file, wraps an unsigned short host counter so process_arguments() allocates an undersized hosts array and writes later entries past its end, all before main() performs setuid(getuid()). This is a moderate, locally-scoped privilege-escalation risk rather than an urgent remote threat: there is no remote vector, reliable privilege escalation from the corruption has not been demonstrated, and no public exploit code was identified in the available sources; the fix is enforcing an explicit host-count bound.
Credential and authentication-token disclosure in Linuxfabrik monitoring-plugins (versions 6.0.0 and earlier) affects the redfish-* check plugins used with Icinga, Nagios, and compatible systems. The plugins build Redfish request URLs by blindly concatenating the operator-supplied base URL with @odata.id links returned in the BMC response, so a malicious or compromised BMC can redirect the plugin's authenticated follow-up requests to an attacker-controlled host and harvest the X-Auth-Token session token or HTTP Basic credentials sent with them. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the CVSS 4.0 base score is 8.3.
Cross-origin credential header leakage in linuxfabrik-lib prior to v6.0.0 exposes API tokens from authenticated monitoring requests to attacker-controlled redirect targets. The lib.url.fetch() function relied on httpx's default redirect behavior, which strips only Authorization and Cookie on cross-origin hops - leaving custom credential headers like X-Auth-Token and X-Api-Key forwarded verbatim to whatever host the redirect points to. This is particularly severe for Redfish/BMC monitoring workflows where X-Auth-Token grants privileged hardware management access. No public exploit has been identified at time of analysis, and active exploitation is not confirmed in CISA KEV.
Symlink-following in Linuxfabrik monitoring-plugins 6.0.0 allows a local low-privileged user sharing the plugin account to overwrite or corrupt arbitrary root-owned files. The logfile check's legacy database migration resolved a predictable /tmp path via os.rename() without guarding against symlink substitution, and sqlite3.connect() would then follow the attacker-planted link during a root-executed check run. No public exploit has been identified, and exploitation is additionally constrained by the non-default kernel setting fs.protected_symlinks=0, meaningfully reducing real-world risk on hardened systems.
Heap memory corruption in the check_icmp plugin shipped with Monitoring Plugins 3.0.0-rc1 through 3.0.0 gives a local low-privileged user an out-of-bounds write inside a process that still holds root privileges when check_icmp is installed setuid-root. Passing more than 65,535 hosts, either as repeated -H/--Host arguments or as Host= entries in an --extra-opts ini file, wraps an unsigned short host counter so process_arguments() allocates an undersized hosts array and writes later entries past its end, all before main() performs setuid(getuid()). This is a moderate, locally-scoped privilege-escalation risk rather than an urgent remote threat: there is no remote vector, reliable privilege escalation from the corruption has not been demonstrated, and no public exploit code was identified in the available sources; the fix is enforcing an explicit host-count bound.
Credential and authentication-token disclosure in Linuxfabrik monitoring-plugins (versions 6.0.0 and earlier) affects the redfish-* check plugins used with Icinga, Nagios, and compatible systems. The plugins build Redfish request URLs by blindly concatenating the operator-supplied base URL with @odata.id links returned in the BMC response, so a malicious or compromised BMC can redirect the plugin's authenticated follow-up requests to an attacker-controlled host and harvest the X-Auth-Token session token or HTTP Basic credentials sent with them. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the CVSS 4.0 base score is 8.3.
Cross-origin credential header leakage in linuxfabrik-lib prior to v6.0.0 exposes API tokens from authenticated monitoring requests to attacker-controlled redirect targets. The lib.url.fetch() function relied on httpx's default redirect behavior, which strips only Authorization and Cookie on cross-origin hops - leaving custom credential headers like X-Auth-Token and X-Api-Key forwarded verbatim to whatever host the redirect points to. This is particularly severe for Redfish/BMC monitoring workflows where X-Auth-Token grants privileged hardware management access. No public exploit has been identified at time of analysis, and active exploitation is not confirmed in CISA KEV.
Symlink-following in Linuxfabrik monitoring-plugins 6.0.0 allows a local low-privileged user sharing the plugin account to overwrite or corrupt arbitrary root-owned files. The logfile check's legacy database migration resolved a predictable /tmp path via os.rename() without guarding against symlink substitution, and sqlite3.connect() would then follow the attacker-planted link during a root-executed check run. No public exploit has been identified, and exploitation is additionally constrained by the non-default kernel setting fs.protected_symlinks=0, meaningfully reducing real-world risk on hardened systems.