ID: 6846
Title: More secure password hashing
Component: Multisite
Level: 2
Class: Security fix
Version: 1.6.0i1
Passwords of local users of the Check_MK GUI are now hashed using SHA256
(salted, 535000 rounds) to increase the security of the stored user logon
passwords.
All existing users will still be able to login using their already hashed
passwords. Once a user changes his password or a new user is created, these
will be hashed using the new algorithm.
Why SHA256? Check_MK supports different authentication frontends for verifying
the local credentials: a) basic authentication (done by apache) and b) the GUI
form + cookie based authentication.
The default is b). This option is toggled with the "omd config" option
MULTISITE_COOKIE_AUTH. In case the basic authentication is chosen it is only
possible to use hashing algorithms that are supported by apache which
performs the authentication in this situation.
For best compatibility in all mentioned situations we use the SHA256 scheme.
ID: 6507
Title: Fixed 100% CPU usage of the CMC after writing to its command pipe
Component: Core & setup
Level: 2
Class: Bug fix
Version: 1.6.0i1
After writing to its command pipe tmp/run/nagios.cmd, the CMC's CPU usage
went up to 100%. This has been fixed.
ID: 6786
Title: Livestatus proxy: Fixed file path traversal vulnerability
Component: Livestatus Proxy
Level: 2
Class: Security fix
Version: 1.6.0i1
The livestatus proxy connects to the livestatus server of remote sites. One task is to
fetch the inventory data of the remote site and replicate it to the master site to make
client accesses faster.
The livestatus proxy was not validating the incoming data correctly which made it possible
for an attacker that has access to the remote sites to compromise the site the livestatus
proxy daemon is running in.
Using this vulnerability it was possible to write write files in directories that are writable
by the liveproxy site user. This could be used to gain access to the liveproxy site.
ID: 6787
Title: Notification spooler: Fixed file path traversal vulnerability
Component: Notifications
Level: 2
Class: Security fix
Version: 1.6.0i1
The notification daemon of one site connects to the notification daemon of another site
to exchange notifications between both sites.
The notification daemon was not validating the incoming data correctly which made it possible
for an attacker that has access to the notification sending site to compromise the receiving
site.
Using this vulnerability it was possible to write write files in directories that are writable
by the receiving site user. This could be used to gain access to the site.
ID: 6788
Title: Notification spooler: Fixed deserialization of arbitrary input
Component: Notifications
Level: 2
Class: Security fix
Version: 1.6.0i1
The notification daemon of one site connects to the notification daemon of
another site to exchange notifications between both sites.
The messages that are sent between the notification daemons were encoded in an
insecure format which allowed code injections between the communication
partners. This means it was possible to inject code from one notification
spooler to another.
We have now changed the message format to a secure alternative which prevents
code injections.
To be able to perform this transition without loosing notifications and
preventing subtile incompatibilities we decided to keep the new format disabled
by default for all sites created with Check_MK 1.4 and 1.5. This means your
installation will still be affected by this issue by default after updating.
However, once you have updated all your sites to at least 1.4.0p37 in case of
the 1.4.0 branch or or at least 1.5.0p7 in case of the 1.5.0 branch you can
change the main configuration option "Notification Spooler insecure messages"
to "off" and activate the new configuration. Once you have done this all
notification spoolers will use the new secure message format.
Please note that the 1.6 notification spoolers will always use the new message
format and not be compatible to the old message format of the 1.5 notification
spoolers anymore. If you plan to use 1.5 and 1.6 together during migration you
will have to ensure that you use the new message format in your 1.5 sites.
ID: 6780
Title: Fixed random alert / notify helper crashes on some platforms
Component: Core & setup
Level: 2
Class: Bug fix
Version: 1.6.0i1
The alert and notify helpers of the Microcore could crash "randomly"
after hours of operation.
The crash was visible in form of "ImportError: cannot import name" messages
in the var/log/notify.log or var/log/alert.log.
Due to another problem, which will also be fixed soon, the crash of the
helper process made the Microcore process crash.
As far as we know this happened only on Debian Jessie, CentOS/RedHat 7 and
SLES12 SP1/SP2.
CMK-1085
ID: 6779
Title: Fixed displaying unrelated livestatus data to users randomly
Component: Multisite
Level: 2
Class: Bug fix
Version: 1.6.0i1
Because subsequent requests to the GUI could use left over livestatus connections
of other users it could randomly happen that one user used the livestatus connection
of another user which could then result in wrong data shown to the user in the
GUI.