Checkmk werks level1 March 2024

checkmk-werks-lvl1@lists.checkmk.com

1 participants
258 discussions

[2.2.0] Checkmk Werk 15487 created: Fix indentation of tree of folders snapin

by Checkmk werks level 1

Title: Fix indentation of tree of folders snapin Class: fix Compatible: compat Component: multisite Date: 1683124911 Edition: cre Level: 1 Version: 2.2.0p24

7 months, 3 weeks

[2.2.0] Checkmk Werk 16198 created: mk_informix: Do not allow privilege escalation

by Checkmk werks level 1

Title: mk_informix: Do not allow privilege escalation Class: security Compatible: compat Component: checks Date: 1709909870 Edition: cre Level: 1 Version: 2.2.0p24 The informix database monitoring plugin would previously <code>eval</code> statements parsed from <code>$INFORMIXDIR/bin/onstat</code>. Since the plugin is usually run as root, this could cause statements injected in <code>$INFORMIXDIR/bin/onstat</code> to be run as root as well. By adding scripts named the same as other functionality found in <code>$PATH</code> to <code>$INFORMIXDIR/bin</code>, <code>$PATH</code> functionality could also be overshadowed and the custom executed as root. Finally, <code>$INFORMIXDIR/bin/onstat</code> would be executed as root, allowing a substituted script to be run with elevated privileges. With this werk, the environment variables will be exported instead and <code>$PATH</code> will now be searched before <code>$INFORMIXDIR/bin</code>. The plugin will now also check if <code>$INFORMIXDIR/bin/onstat</code> belongs to root if the plugin is executed as root. If not, it will be executed as the user owning the executable. This issue was found during internal review. <em>Affected Versions</em>: LI: 2.3.0 (beta) LI: 2.2.0 LI: 2.1.0 LI: 2.0.0 (EOL) <em>Vulnerability Management</em>: We have rated the issue with a CVSS Score of 8.8 (High) with the following CVSS vector: <code>CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H</code> and assigned CVE <code>CVE-2024-28824</code>.

7 months, 3 weeks

[2.2.0] Checkmk Werk 16234 created: Hide credentials in ps output for mk_oracle

by Checkmk werks level 1

Title: Hide credentials in ps output for mk_oracle Class: security Compatible: compat Component: checks Date: 1708454375 Edition: cre Level: 1 Version: 2.2.0p24 In the mk_oracle plugin <tt>sqlplus</tt> used to be called with the connection string as an argument. This connection string could contain credentials necessary to authenticate against the database. These arguments could be extracted by other users (e.g. with use of <tt>ps</tt>). This vulnerability was reported to us, we are not aware of any exploitations. <b>Affected Versions:</b> 2.2.0 2.1.0 2.0.0 (probably older versions as well) <b>Vulnerability Management:</b> We have rated the issue with a CVSS Score of 3.8 (Low) with the following CVSS vector: <tt>CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N</tt>. We assigned CVE-2024-1742 to this vulnerability. <b>Changes:</b> With this Werk the connection string is now piped via stdin to <tt>sqlplus</tt>.

7 months, 3 weeks

[2.2.0] Checkmk Werk 16232 created: mk_oracle(ps1): Prevent privilege esclation to root

by Checkmk werks level 1

Title: mk_oracle(ps1): Prevent privilege esclation to root Class: security Compatible: compat Component: checks Date: 1705479643 Edition: cre Level: 3 Version: 2.2.0p24 The agent plugins mk_oracle, mk_oracle.ps1 and mk_oracle_crs were vulnerable to privilege escalation to root by the oracle user. A malicious oracle user could replace a binary (e.g. sqlplus) with another script and put it in the corresponding directory. The script would be executed by the root user. All binaries, which are called by the plugins, are now checked if they need to be executed as a non-root (non-administrator under Windows) user, preventing the privilege escalation. Affected binaries are: sqlplus, tnsping, crsctl. <h3>Affected Versions</h3> LI: 2.3.0 (beta) LI: 2.2.0 LI: 2.1.0 LI: 2.0.0 (EOL) and older <h3>Mitigations</h3> If updating is not possible, disable the mk_oracle plugin. <h3>Vulnerability Management</h3> We have rated the issue with a CVSS score of 8.2 (High) with the following CVSS vector: <code>CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H</code> We have assigned <code>CVE-2024-0638</code>. <h3>Changes</h3> All called binaries are now executed in a safe way.

7 months, 3 weeks

[2.2.0] Checkmk Werk 16176 deleted: postfix: Fix Postfix status monitoring for agents run in Docker

by Checkmk werks level 1

Werk 16176 was deleted. The following Werk is no longer relevant. Title: postfix: Fix Postfix status monitoring for agents run in Docker Class: fix Compatible: compat Component: checks Date: 1710323821 Edition: cre Level: 1 Version: 2.2.0p24 Previously, Checkmk agent used the data from /proc to determine if Postfix instance is running. Since docker containers don't have permissions to read /proc, the agent always reported the Postfix instance as 'not running'. This resulted in CRIT 'Postfix status' service even if Postfix instance was running correctly.

7 months, 3 weeks

[2.4.0] Checkmk Werk 16487 created: fortigate_signatures: Crash (Cannot render negative timespan)

by Checkmk werks level 1

[//]: # (werk v2) # fortigate_signatures: Crash (Cannot render negative timespan) key | value ---------- | --- date | 2024-03-19T14:31:54+00:00 version | 2.4.0b1 class | fix edition | cre component | checks level | 1 compatible | yes If the age reported by a Fortigate signature is in the future, the service would crash when rendering the age of the signature. If this is the case, the service will now display a hint to check your system time.

7 months, 3 weeks

[2.4.0] Checkmk Werk 16234 created: Hide credentials in ps output for mk_oracle

by Checkmk werks level 1

[//]: # (werk v2) # Hide credentials in ps output for mk_oracle key | value ---------- | --- compatible | yes version | 2.4.0b1 date | 2024-02-20T18:39:35+00:00 level | 1 class | security component | checks edition | cre In the mk_oracle plugin <tt>sqlplus</tt> used to be called with the connection string as an argument. This connection string could contain credentials necessary to authenticate against the database. These arguments could be extracted by other users (e.g. with use of <tt>ps</tt>). This vulnerability was reported to us, we are not aware of any exploitations. <b>Affected Versions:</b> 2.2.0 2.1.0 2.0.0 (probably older versions as well) <b>Vulnerability Management:</b> We have rated the issue with a CVSS Score of 3.8 (Low) with the following CVSS vector: <tt>CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N</tt>. We assigned CVE-2024-1742 to this vulnerability. <b>Changes:</b> With this Werk the connection string is now piped via stdin to <tt>sqlplus</tt>.

7 months, 3 weeks

[2.4.0] Checkmk Werk 16232 created: mk_oracle(ps1): Prevent privilege esclation to root

by Checkmk werks level 1

[//]: # (werk v2) # mk_oracle(ps1): Prevent privilege esclation to root key | value ---------- | --- compatible | yes version | 2.4.0b1 date | 2024-01-17T08:20:43+00:00 level | 3 class | security component | checks edition | cre The agent plugins mk_oracle, mk_oracle.ps1 and mk_oracle_crs were vulnerable to privilege escalation to root by the oracle user. A malicious oracle user could replace a binary (e.g. sqlplus) with another script and put it in the corresponding directory. The script would be executed by the root user. All binaries, which are called by the plugins, are now checked if they need to be executed as a non-root (non-administrator under Windows) user, preventing the privilege escalation. Affected binaries are: sqlplus, tnsping, crsctl. <h3>Affected Versions</h3> * 2.3.0 (beta) * 2.2.0 * 2.1.0 * 2.0.0 (EOL) and older <h3>Mitigations</h3> If updating is not possible, disable the mk_oracle plugin. <h3>Vulnerability Management</h3> We have rated the issue with a CVSS score of 8.2 (High) with the following CVSS vector: <code>CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H</code> We have assigned <code>CVE-2024-0638</code>. <h3>Changes</h3> All called binaries are now executed in a safe way.

7 months, 3 weeks

[2.4.0] Checkmk Werk 16198 created: mk_informix: Do not allow privilege escalation

by Checkmk werks level 1

[//]: # (werk v2) # mk_informix: Do not allow privilege escalation key | value ---------- | --- date | 2024-03-08T14:57:50+00:00 version | 2.4.0b1 class | security edition | cre component | checks level | 1 compatible | yes The informix database monitoring plugin would previously `eval` statements parsed from `$INFORMIXDIR/bin/onstat`. Since the plugin is usually run as root, this could cause statements injected in `$INFORMIXDIR/bin/onstat` to be run as root as well. By adding scripts named the same as other functionality found in `$PATH` to `$INFORMIXDIR/bin`, `$PATH` functionality could also be overshadowed and the custom executed as root. Finally, `$INFORMIXDIR/bin/onstat` would be executed as root, allowing a substituted script to be run with elevated privileges. With this werk, the environment variables will be exported instead and `$PATH` will now be searched before `$INFORMIXDIR/bin`. The plugin will now also check if `$INFORMIXDIR/bin/onstat` belongs to root if the plugin is executed as root. If not, it will be executed as the user owning the executable. This issue was found during internal review. *Affected Versions*: * 2.3.0 (beta) * 2.2.0 * 2.1.0 * 2.0.0 (EOL) *Vulnerability Management*: We have rated the issue with a CVSS Score of 8.8 (High) with the following CVSS vector: `CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H` and assigned CVE `CVE-2024-28824`.

7 months, 3 weeks

[2.4.0] Checkmk Werk 16626 created: trigger openapi-spec generation job during start, restart and reload

by Checkmk werks level 1

[//]: # (werk v2) # trigger openapi-spec generation job during start, restart and reload key | value ---------- | --- date | 2024-03-20T13:23:59+00:00 version | 2.4.0b1 class | feature edition | cre component | omd level | 1 compatible | yes Werk 16501 introduced a command to start a background job which triggers the regeneration of the API specification. This werk now includes execution of this command also during omd start, restart, and reload. With this mechanism the execution during `cmk-update-config` is no longer needed. Based on Werk 15724 the specification is now updated in these situations: * Create the initial spec after a site has been created * Update the spec after a site has been copied, restored or renamed * Update the spec when the apache process is started, restarted or reloaded

7 months, 3 weeks

← Newer
1
...
8
9
10
11
12
13
14
...
26
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

Checkmk werks level1 March 2024