Two vulnerabilities have been identified in Monit, which can be exploited by malicious people to compromise a vulnerable system.

1) A boundary error in the HTTP interface can be exploited to cause a buffer overflow by supplying an overly long HTTP method. This may allow execution of arbitrary code.

2) An integer overflow with in the POST request input handler can potentially be exploited for arbitrary code execution by supplying a large HTTP POST request with a value of -1 in the "Content-Length:" header field.

Successful exploitation requires that Monit has been started with HTTP support.

The vulnerabilities affect versions 4.1 and prior.

Solution
Update to version 4.1.1.
Further details available in Customer Area

Provided and/or discovered by
Originally discovered by Evgeny Legerov.
Updated information about integer overflow by Matthew Murphy.

Changelog
Further details available in Customer Area

Original Advisory
Product changelog
http://www.tildeslash.com/monit/dist/CHANGES.txt

Monit 4.1 HTTP interface Multiple Security Vulnerabilities:
http://www.s-quadra.com/advisories/Adv-20031124.txt

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area