CVE-2006-2489

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 5.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2006-05-19 · updated 2026-06-16

Description

Integer overflow in CGI scripts in Nagios 1.x before 1.4.1 and 2.x before 2.3.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a content length (Content-Length) HTTP header. NOTE: this is a different vulnerability than CVE-2006-2162.

Affected products

Nagios Enterprises nagios: 1.0, 1.0b1, 1.0b2, 1.0b3, 1.0b4, 1.0b5 (+17)

References

http://secunia.com/advisories/20123
http://secunia.com/advisories/20247
http://secunia.com/advisories/20313
http://www.debian.org/security/2006/dsa-1072
http://www.gentoo.org/security/en/glsa/glsa-200605-07.xml
http://www.nagios.org/development/changelog.php
http://www.securityfocus.com/bid/18059
http://www.vupen.com/english/advisories/2006/1822
https://exchange.xforce.ibmcloud.com/vulnerabilities/26454
https://usn.ubuntu.com/287-1/
http://secunia.com/advisories/20123
http://secunia.com/advisories/20247

Get alerted when CVE-2006-2489 or the next vulnerability affects your stack