Vulnerability record · CVE-2013-7108 · published 15 January 2014
CVE-2013-7108: Nagios Core and Icinga CGI off-by-one memory over-read
Nagios · Nagios
Multiple off-by-one errors in the process_cgivars function of Nagios Core 3.5.1, 4.0.2 and earlier, and Icinga before 1.8.5, 1.9.4 and 1.10.2, allow a remote authenticated user to trigger a heap-based buffer over-read by supplying a long string as the last key value in the variable list. The flaw affects eleven CGI programs in cgi/ and can leak process memory contents or crash the service.
Description
Multiple off-by-one errors in Nagios Core 3.5.1, 4.0.2, and earlier, and Icinga before 1.8.5, 1.9 before 1.9.4, and 1.10 before 1.10.2 allow remote authenticated users to obtain sensitive information from process memory or cause a denial of service (crash) via a long string in the last key value in the variable list to the process_cgivars function in (1) avail.c, (2) cmd.c, (3) config.c, (4) extinfo.c, (5) histogram.c, (6) notifications.c, (7) outages.c, (8) status.c, (9) statusmap.c, (10) summary.c, and (11) trends.c in cgi/, which triggers a heap-based buffer over-read.
AV:N/AC:L/Au:S/C:P/I:N/A:P
Automated analysis
medium priorityThe flaw requires authentication and yields only partial information disclosure or denial of service, though the high EPSS score and wide deployment of Nagios and Icinga keep it relevant.
What it is
Multiple off-by-one errors in the process_cgivars function of Nagios Core 3.5.1, 4.0.2 and earlier, and Icinga before 1.8.5, 1.9.4 and 1.10.2, allow a remote authenticated user to trigger a heap-based buffer over-read by supplying a long string as the last key value in the variable list. The flaw affects eleven CGI programs in cgi/ and can leak process memory contents or crash the service.
Impact
An attacker gains partial disclosure of process memory, which may expose sensitive data, and can cause a denial of service by crashing the affected CGI process.
Attack surface
Reached over the network through the affected CGI endpoints by an authenticated user; no user interaction is required beyond sending the crafted request, per the AV:N/AC:L/Au:S vector.
Exploitation
Not listed in CISA KEV and no public exploit references are tagged in the record, but EPSS is high at 0.595 (99th percentile), indicating elevated likelihood of attempted exploitation.
What to do
- Upgrade Nagios Core to a version after 4.0.2 and Icinga to 1.8.5, 1.9.4, 1.10.2 or later as applicable.
- Apply vendor and distribution updates referenced in the OpenSUSE, Mandriva and Debian advisories.
- Restrict access to the Nagios/Icinga CGI interface to trusted networks and authenticated administrative users only.
- Review and limit which accounts are permitted to reach the CGI endpoints, since exploitation requires authentication.
Detection
- Monitor web server logs for unusually long parameter values or malformed variable lists sent to Nagios/Icinga CGI paths.
- Alert on repeated crashes or restarts of CGI processes such as status.cgi, cmd.cgi or avail.cgi.
- Correlate authenticated sessions issuing abnormal requests to multiple cgi/ endpoints in a short window.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2013-7108 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2013-7108), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
