Local Privilege Escalation in Icinga Core by Icinga Software

CVE-2017-16882

What is CVE-2017-16882?

Icinga Core versions up to 1.14.0 are susceptible to a local privilege escalation issue where the application initially executes critical binaries, such as bin/icinga, as the root user. This vulnerability arises from configuration options that permit these binaries, as well as etc/icinga.cfg, to be owned by a non-root account. As a result, local users with access to a non-root account can exploit this misconfiguration, resulting in unauthorized privilege escalation. Additional impacted components include bin/icingastats, bin/ido2db, and bin/log2ido, allowing for a broader attack surface within the Icinga Core environment.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References