security fixes (also affecting nagios; icinga 1.x is the old nagios-derived
branch, whereas 2.x is all new) -
* Bug #13709: CVE-2016-9566: Root priviledge escalation during log file opening
* Bug #10453: Icinga Classic-UI 1.13.3 and older are vulnerable to XSS - CVE-2015-8010
notable changes -
* Classic UI: Remove attribute based authorization (cgiauth.cfg is not parsed
any more)
* IDO: Remove deprecated config options
instructions are meant to work on a fresh install.
- easy cases: replace some '$ sudo somecommand' with '# somecommand'
(while there I've swapped some "${RCDIR}/foo start" with "rcctl foo start").
- replace some 'sudo -u user somecommand foo bar' with
'su -s /bin/sh user "/path/to/somecommand foo bar"' and similar.
Not pretty with the -s, but many of the uids that need to run
these commands have /sbin/nologin as their usual shell.
* classic-ui: fix status.cgi gets stuck in loop when sorting on "All Unhandled Problems" #5886 - RB
* classic ui: Only show command expander if backend is Icinga 1.x (incompatible with Icinga 2) #6408 - MF
* classic ui: Fix CSRF protection in cmd.cgi matches only compiled in URL #6459 - MF
* classic-ui: config.cgi missing new option #6502 - RB
* cgi.cfg: Add url_cgi_path allowing to override the default '$htmurl/cgi-bin' required for CSRF checks #6459
CVE-2013-7106, CVE-2013-7107 https://dev.icinga.org/issues/5250
The icinga web gui is susceptible to several buffer overflow flaws,
which can be triggered as a logged on user. A remote attacker may
utilize a CSRF (cross site request forgery) attack vector against a
logged in user to exploit this flaw remotely.
CVE-2013-7108 https://dev.icinga.org/issues/5251
The icinga web gui are susceptible to an "off-by-one read" error
resulting from an improper assumption in the handling of user submitted
CGI parameters. [..] by sending a specially crafted cgi parameter,
the check routine can be forced to skip the terminating null pointer
and read the heap address right after the end of the parameter list.
Depending on the memory layout, this may result in a memory corruption
condition/crash or reading of sensitive memory locations.
Also thanks to Michael Friedrich (upstream) for sending out helpful notes
to package maintainers about changes in the release which may affect them,
we like projects who do that :)
- slight tweaks to upgrade documentation while there; you should still
check the proper upgrade notes from upstream, but the README now points
idodb users at the actual location of the schema update files to save
a bit of hunting.
- attach icinga-web to build
icinga-core:
- bump REVISION for -main, -cgi and -ido
- remove CFGDIR, MAKE_FLAGS from Makefile which are relics
- replace /var/www with ${PREFIX-cgi}
- add instructions for icinga-web to README
- choose mysql by default
icinga-web:
- bump REVISION
- remove README, all instructions are in the icinga-core README
- remove comments about w.i.p
- choose mysql by default
- tell configure where to find icinga binary, icinga.cfg and the
icinga objects dir
- add icinga, icinga-idoutils and bash to RUN_DEPENDS
- patch shells scripts to use the correct path for bash
- patch databases.xml.in to have both DBs enabled by default
with help and ok from sthen aja
steps, edit icinga.cfg and change broker_module=/usr/local/bin/idomod.o
to broker_module=/usr/local/lib/idomod.so, this is also mentioned in the
README.
Notable fixes:
- flexible downtimes now last the duration specified once triggered
- avoid insane looping through event list when rescheduling checks
parameter to daemonize, move the parameter from daemon to daemon_flags,
so that the user cannot inadvertently prevent it from daemonizing by
adjusting the flags.
Discussed with ajacoutot and schwarze, this method was suggested
by schwarze@ as a simpler alternative to my diff. ok aja@
