7.8

CVE-2016-8641

Exploit
A privilege escalation vulnerability was found in nagios 4.2.x that occurs in daemon-init.in when creating necessary files and insecurely changing the ownership afterwards. It's possible for the local attacker to create symbolic links before the files are to be created and possibly escalating the privileges with the ownership change.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Nagios ≫ Nagios Version4.2.0
Nagios ≫ Nagios Version4.2.1
Nagios ≫ Nagios Version4.2.2
Nagios ≫ Nagios Version4.2.3
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.15% 0.627
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.8 1.8 5.9
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 7.2 3.9 10
AV:L/AC:L/Au:N/C:C/I:C/A:C
secalert@redhat.com 6.7 0.8 5.9
CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
CWE-59 Improper Link Resolution Before File Access ('Link Following')

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

https://security.gentoo.org/glsa/201702-26
Third Party Advisory
http://www.securityfocus.com/bid/95121
Third Party Advisory
VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8641
Patch
Third Party Advisory
Issue Tracking
https://github.com/NagiosEnterprises/nagioscore/commit/f2ed227673d3b2da643eb5cad26b2d87674f28c1.patch
Patch
Third Party Advisory
https://www.exploit-db.com/exploits/40774/
Third Party Advisory
Exploit
VDB Entry