Denial of Service in munin
Summary
DSA-2815-1: munin - denial of service. Affects munin versions < 2.0.6-4+deb7u2. Fixed in 2.0.6-4+deb7u2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Munin is a network-wide graphing framework that allows monitoring of various resources on multiple hosts. It provides a web interface for visualizing and analyzing collected data. Munin consists of a master node and multiple client nodes, where the master node collects data from the clients and generates graphs. The Munin::Master::Node module is responsible for communication between the master and client nodes.
Vulnerability Detail
Two denial of service vulnerabilities have been discovered in munin:
-
CVE-2013-6048: The Munin::Master::Node module of munin does not properly validate certain data sent by a node. This can be exploited by a malicious node to drive the munin-html process into an infinite loop, leading to memory exhaustion on the munin master.
-
CVE-2013-6359: A malicious node with a plugin enabled using multigraph as a multigraph service name can abort data collection for the entire node the plugin runs on.
How To Fix
Minimum fixed version
2.0.6-4+deb7u2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade muninTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no specific workarounds mentioned for these vulnerabilities.
Conclusion
Two denial of service vulnerabilities have been discovered in munin. It is recommended to upgrade your munin packages to the fixed versions mentioned in the 'how_to_fix' section. If you need further assistance or support in vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for munin →
FAQ
Munin is a network-wide graphing framework used for monitoring resources on multiple hosts.
CVE-2013-6048 can be exploited by a malicious node to cause memory exhaustion on the munin master, leading to denial of service.
CVE-2013-6359 allows a malicious node to abort data collection for the entire node the plugin runs on, causing potential data loss or disruption in monitoring.
To fix these vulnerabilities, upgrade your munin packages to the recommended versions mentioned in the 'how_to_fix' section.
No specific workarounds have been mentioned for these vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for munin.
