/* strip > and < from string */
void strip_html_brackets(char *buffer){
register int x;
register int y;
register int z;
if(buffer==NULL || buffer[0]=='\x0')
return;
/* remove all occurances in string */
z=(int)strlen(buffer);
for(x=0,y=0;x<z;x++){
if(buffer[x]=='<' || buffer[x]=='>')
continue;
buffer[y++]=buffer[x];
}
buffer[y++]='\x0';
return;
}
-----------
statusmap.c
-----------
/* we found the layer argument */
else if(!strcmp(variables[x],"layer")){
x++;
if(variables[x]==NULL){
error=TRUE;
break;
}
strip_html_brackets(variables[x]);
add_layer(variables[x]);
}
-----------
Problem in "statusmap.c"
-----------
/* print layer url info */
void print_layer_url(int get_method){
layer *temp_layer;
for(temp_layer=layer_list;temp_layer!=NULL;temp_layer=temp_layer->next){
if(get_method==TRUE)
printf("&layer=%s",temp_layer->layer_name); <-- no "escape_string"
else
printf("<input type='hidden' name='layer' value='%s'>\n",escape_string(temp_layer->layer_name));
}
=========
Solution:
=========
if(get_method==TRUE)
/* printf("&layer=%s",temp_layer->layer_name); */
printf("&layer=%s",escape_string(temp_layer->layer_name));
====================
Disclosure Timeline:
====================
09-Mar-2011 - informed developers
09-Mar-2011 - post on Nagios Tracker - http://tracker.nagios.org/view.php?id=207
09-Mar-2011 - Release date of this security advisory
10-Mar-2011 - post on BugTraq - http://www.securityfocus.com/archive/1/516934/30/0/threaded
========
Credits:
========
Vulnerability found and advisory written by Stefan Schurtz.
===========
References:
===========
http://www.nagios.org
http://www.rul3z.de/advisories/SSCHADV2011-002.txt
