CVE-2016-8641
A privilege escalation vulnerability was found in nagios 4.2.x that occurs in daemon-init.in when creating necessary files and insecurely changing the ownership afterwards.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.14%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
A privilege escalation vulnerability was found in nagios 4.2.x that occurs in daemon-init.in when creating necessary files and insecurely changing the ownership afterwards. It's possible for the local attacker to create symbolic links before the files are to be created and possibly escalating the privileges with the ownership change.
- CVSS 3.0
- 7.8 HIGHCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 1.14% probability · 65th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-59
- Affected
- nagios/nagios
- Source
- secalert@redhat.com
References
- http://www.securityfocus.com/bid/95121Third Party Advisory, VDB Entry
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8641Issue Tracking, Patch, Third Party Advisory
- https://github.com/NagiosEnterprises/nagioscore/commit/f2ed227673d3b2da643eb5cad26b2d87674f28c1.patchPatch, Third Party Advisory
- https://security.gentoo.org/glsa/201702-26Third Party Advisory
- https://www.exploit-db.com/exploits/40774/Exploit, Third Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/95121Third Party Advisory, VDB Entry
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8641Issue Tracking, Patch, Third Party Advisory
- https://github.com/NagiosEnterprises/nagioscore/commit/f2ed227673d3b2da643eb5cad26b2d87674f28c1.patchPatch, Third Party Advisory
- https://security.gentoo.org/glsa/201702-26Third Party Advisory
- https://www.exploit-db.com/exploits/40774/Exploit, Third Party Advisory, VDB Entry
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.