Privilege Escalation Vulnerability in Nagios by Nagios Enterprises
CVE-2016-8641

6.7MEDIUM

Key Information:

Vendor

NagiOS Enterprises

Status
NagiOS
Vendor
CVE Published:
1 August 2018

What is CVE-2016-8641?

A privilege escalation issue exists in Nagios 4.2.x, specifically in daemon-init.in, where improper handling of file ownership can be exploited. Local attackers may create symbolic links prior to the creation of certain files, enabling them to change file ownership inappropriately. This flaw could allow attackers to gain escalated privileges on the affected system, posing a significant risk to system integrity and security.

Affected Version(s)

nagios 4.2.x

References

https://www.exploit-db.com/exploits/40774/
exploitx_refsource_EXPLOIT-DB
https://github.com/NagiosEnterprises/nagioscore/commit/f2...
x_refsource_CONFIRM
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8641
x_refsource_CONFIRM

CVSS V3.1

Score:
6.7
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.