Checkmk werks level2 October 2018

checkmk-werks-lvl2@lists.checkmk.com

2 participants
7 discussions

Check_MK Werk 6846: More secure password hashing

by Lars Michelsen

ID: 6846 Title: More secure password hashing Component: Multisite Level: 2 Class: Security fix Version: 1.6.0i1 Passwords of local users of the Check_MK GUI are now hashed using SHA256 (salted, 535000 rounds) to increase the security of the stored user logon passwords. All existing users will still be able to login using their already hashed passwords. Once a user changes his password or a new user is created, these will be hashed using the new algorithm. Why SHA256? Check_MK supports different authentication frontends for verifying the local credentials: a) basic authentication (done by apache) and b) the GUI form + cookie based authentication. The default is b). This option is toggled with the "omd config" option MULTISITE_COOKIE_AUTH. In case the basic authentication is chosen it is only possible to use hashing algorithms that are supported by apache which performs the authentication in this situation. For best compatibility in all mentioned situations we use the SHA256 scheme.

5 years, 10 months

Check_MK Werk 6507: Fixed 100% CPU usage of the CMC after writing to its command pipe

by Sven Panne

ID: 6507 Title: Fixed 100% CPU usage of the CMC after writing to its command pipe Component: Core & setup Level: 2 Class: Bug fix Version: 1.6.0i1 After writing to its command pipe tmp/run/nagios.cmd, the CMC's CPU usage went up to 100%. This has been fixed.

5 years, 10 months

Check_MK Werk 6786: Livestatus proxy: Fixed file path traversal vulnerability

by Lars Michelsen

ID: 6786 Title: Livestatus proxy: Fixed file path traversal vulnerability Component: Livestatus Proxy Level: 2 Class: Security fix Version: 1.6.0i1 The livestatus proxy connects to the livestatus server of remote sites. One task is to fetch the inventory data of the remote site and replicate it to the master site to make client accesses faster. The livestatus proxy was not validating the incoming data correctly which made it possible for an attacker that has access to the remote sites to compromise the site the livestatus proxy daemon is running in. Using this vulnerability it was possible to write write files in directories that are writable by the liveproxy site user. This could be used to gain access to the liveproxy site.

5 years, 10 months

Check_MK Werk 6787: Notification spooler: Fixed file path traversal vulnerability

by Lars Michelsen

ID: 6787 Title: Notification spooler: Fixed file path traversal vulnerability Component: Notifications Level: 2 Class: Security fix Version: 1.6.0i1 The notification daemon of one site connects to the notification daemon of another site to exchange notifications between both sites. The notification daemon was not validating the incoming data correctly which made it possible for an attacker that has access to the notification sending site to compromise the receiving site. Using this vulnerability it was possible to write write files in directories that are writable by the receiving site user. This could be used to gain access to the site.

5 years, 10 months

Check_MK Werk 6788: Notification spooler: Fixed deserialization of arbitrary input

by Lars Michelsen

ID: 6788 Title: Notification spooler: Fixed deserialization of arbitrary input Component: Notifications Level: 2 Class: Security fix Version: 1.6.0i1 The notification daemon of one site connects to the notification daemon of another site to exchange notifications between both sites. The messages that are sent between the notification daemons were encoded in an insecure format which allowed code injections between the communication partners. This means it was possible to inject code from one notification spooler to another. We have now changed the message format to a secure alternative which prevents code injections. To be able to perform this transition without loosing notifications and preventing subtile incompatibilities we decided to keep the new format disabled by default for all sites created with Check_MK 1.4 and 1.5. This means your installation will still be affected by this issue by default after updating. However, once you have updated all your sites to at least 1.4.0p37 in case of the 1.4.0 branch or or at least 1.5.0p7 in case of the 1.5.0 branch you can change the main configuration option "Notification Spooler insecure messages" to "off" and activate the new configuration. Once you have done this all notification spoolers will use the new secure message format. Please note that the 1.6 notification spoolers will always use the new message format and not be compatible to the old message format of the 1.5 notification spoolers anymore. If you plan to use 1.5 and 1.6 together during migration you will have to ensure that you use the new message format in your 1.5 sites.

5 years, 10 months

Check_MK Werk 6780: Fixed random alert / notify helper crashes on some platforms

by Lars Michelsen

ID: 6780 Title: Fixed random alert / notify helper crashes on some platforms Component: Core & setup Level: 2 Class: Bug fix Version: 1.6.0i1 The alert and notify helpers of the Microcore could crash "randomly" after hours of operation. The crash was visible in form of "ImportError: cannot import name" messages in the var/log/notify.log or var/log/alert.log. Due to another problem, which will also be fixed soon, the crash of the helper process made the Microcore process crash. As far as we know this happened only on Debian Jessie, CentOS/RedHat 7 and SLES12 SP1/SP2. CMK-1085

5 years, 11 months

Check_MK Werk 6779: Fixed displaying unrelated livestatus data to users randomly

by Lars Michelsen

ID: 6779 Title: Fixed displaying unrelated livestatus data to users randomly Component: Multisite Level: 2 Class: Bug fix Version: 1.6.0i1 Because subsequent requests to the GUI could use left over livestatus connections of other users it could randomly happen that one user used the livestatus connection of another user which could then result in wrong data shown to the user in the GUI.

5 years, 11 months

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

Checkmk werks level2 October 2018