Assigning to the registered maintainer.

CC: (none) => marja11
Assignee: bugsquad => guillomovitch

Debian has issued an advisory for this on February 25:
https://www.debian.org/security/2017/dsa-3794

It was also fixed upstream in 2.0.31.

Patched packages uploaded for Mageia 5 and Cauldron.

Advisory:
========================

Updated munin packages fix security vulnerability:

Stevie Trujillo discovered a local file write vulnerability in munin, a
network-wide graphing framework, when CGI graphs are enabled. GET parameters
are not properly handled, allowing to inject options into munin-cgi-graph and
overwriting any file accessible by the user running the cgi-process
(CVE-2017-6188).

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6188
https://www.debian.org/security/2017/dsa-3794
========================

Updated packages in core/updates_testing:
========================
munin-2.0.25-1.1.mga5
munin-master-2.0.25-1.1.mga5
munin-node-2.0.25-1.1.mga5
munin-java-plugins-2.0.25-1.1.mga5
munin-async-2.0.25-1.1.mga5

from munin-2.0.25-1.1.mga5.src.rpm

CC: marja11 => (none)
Version: Cauldron => 5
Assignee: guillomovitch => qa-bugs
Whiteboard: MGA5TOO => (none)

MGA5-32 on Asus A6000VM
No installation issues
Ref bug 11944 Comment 4, when pointing to 
http://localhost/munin 
I get Error 403
and in /var/log/httpd/error_log I get
[Tue Feb 28 14:25:06.656432 2017] [autoindex:error] [pid 3574] [client 127.0.0.1:38618] AH01276: Cannot serve directory /var/lib/munin/html/: No matching DirectoryIndex (index.php,index.phtml,index.html) found, and server-generated directory index forbidden by Options directive
[Tue Feb 28 14:25:43.965717 2017] [autoindex:error] [pid 3573] [client 127.0.0.1:38622] AH01276: Cannot serve directory /usr/share/munin/static/: No matching DirectoryIndex (index.php,index.phtml,index.html) found, and server-generated directory index forbidden by Options directive
[Tue Feb 28 14:38:06.228800 2017] [autoindex:error] [pid 3572] [client 127.0.0.1:38636] AH01276: Cannot serve directory /var/lib/munin/html/: No matching DirectoryIndex (index.php,index.phtml,index.html) found, and server-generated directory index forbidden by Options directive
The /etc/httpd/conf/sites.d/munin.conf shows 'Require all granted' for each directory and aliases in place.

I googled on these errors and all I found referred to /etc/munin/apache.conf, but this file does not exist, nor is there any mentionof munin in the httpd.conf file.

CC: (none) => herman.viaene

Debian has done a regression update today (March 2):
https://lists.debian.org/debian-security-announce/2017/msg00053.html

Will update the patch when I get a chance.

Whiteboard: (none) => feedback

Let's get this one out.

Installed all of the munin packages.

Starting with http://guide.munin-monitoring.org/en/latest/installation/configuration.html#configure-web-server
but took some digging to figure out.

[root@i5v ~]# munin-node-configure --shell --families=contrib,auto | sh -x
# The following plugins caused errors:
# hddtemp_smartctl:
#       Junk printed to stderr
# http_loadtime:
#       Non-zero exit during autoconf (2)
# netstat_multi:
#       Wrong amount of autoconf
# proc:
#       In family 'auto' but doesn't have 'autoconf' capability
# samba:
#       Junk printed to stderr
+ ln -s /usr/share/munin/plugins/apc_nis /etc/munin/plugins/apc_nis
+ ln -s /usr/share/munin/plugins/hddtempd /etc/munin/plugins/hddtempd
+ ln -s /usr/share/munin/plugins/meminfo /etc/munin/plugins/meminfo

Enabled and then started the services and apache ...
[root@i5v system]# systemctl enable munin-fcgi-html.service
[root@i5v system]# systemctl enable munin-fcgi-graph.service
[root@i5v system]# systemctl enable munin-node.service
[root@i5v system]# systemctl start munin-fcgi-html.service
[root@i5v system]# systemctl start munin-fcgi-graph.service
[root@i5v system]# systemctl start munin-node.service
[root@i5v system]# systemctl restart httpd.service
Then, as regular user was able to access http://localhost/munin/
and confirmed the graphs are working, and at least some have data.

Installed the updates, restarted apache and confirmed still working.

Same testing completed on my x86_64 Mageia 5 virtualbox host.

Validating the update.

Keywords: (none) => validated_update
Whiteboard: feedback => MGA5-64-OK MGA5-32-OK has_procedure advisory
CC: (none) => davidwhodgins, sysadmin-bugs

An update for this issue has been pushed to the Mageia Updates repository.

http://advisories.mageia.org/MGASA-2017-0101.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED