CVE-2019-11455: 
Monit vulnerability analysis and mitigation

A buffer over-read vulnerability (CVE-2019-11455) was discovered in Tildeslash Monit before version 5.25.3. The vulnerability exists in the Util_urlDecode function in util.c, which allows a remote authenticated attacker to retrieve the contents of adjacent memory through manipulation of GET or POST parameters (CVE MITRE, NVD).

The vulnerability is present in the URL decoding functionality of Monit, specifically in the Util_urlDecode function within util.c. When processing GET or POST parameters, the function can be manipulated to read beyond the intended buffer boundaries, potentially exposing sensitive information from adjacent memory locations. The issue was discovered by security researcher Zack Flack (Debian LTS).

The vulnerability has two primary impacts: first, it allows an authenticated attacker to retrieve contents of adjacent memory, potentially exposing sensitive information. Second, the attacker can cause a denial of service condition resulting in application outage (CVE MITRE).

Proof-of-concept exploits have been publicly released demonstrating both the memory exposure and denial of service capabilities. The exploits require authentication to the Monit service. Working exploit code is available that demonstrates both the buffer over-read vulnerability and the denial of service condition (GitHub Exploits).

The vulnerability was fixed in Monit version 5.25.3. Users are advised to upgrade to this version or later. Multiple Linux distributions have released security updates to address this vulnerability, including Ubuntu (5.25.2-3ubuntu0.1 for 19.04), Debian (1:5.9-1+deb8u2 for Jessie), and Fedora (5.26.0-1.fc32) (Ubuntu Security, Debian LTS).