Vulnerability Name:

CVE-2013-4214 (CCN-86320)

Assigned:2013-08-07
Published:2013-08-07
Updated:2023-02-13
Summary:Nagios could allow a local attacker to launch a symlink attack. The html/rss-newsfeed.php script creates temporary files insecurely. A local attacker could exploit this vulnerability by creating a symbolic link from a temporary file to various files on the system, which could allow the attacker to overwrite arbitrary files on the system with elevated privileges.
CVSS v3 Severity:5.1 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): Low
Availibility (A): Low
CVSS v2 Severity:6.3 Medium (CVSS v2 Vector: AV:L/AC:M/Au:N/C:N/I:C/A:C)
6.3 Medium (Temporal CVSS v2 Vector: AV:L/AC:M/Au:N/C:N/I:C/A:C/E:H/RL:U/RC:C)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Complete
Availibility (A): Complete
3.3 Low (CCN CVSS v2 Vector: AV:L/AC:M/Au:N/C:N/I:P/A:P)
3.3 Low (CCN Temporal CVSS v2 Vector: AV:L/AC:M/Au:N/C:N/I:P/A:P/E:H/RL:U/RC:C)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Medium
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): Partial
Vulnerability Consequences:File Manipulation
References:Source: MITRE
Type: CNA
CVE-2013-4214

Source: secalert@redhat.com
Type: Vendor Advisory
secalert@redhat.com

Source: CCN
Type: oss-sec Mailing List, Wed, 07 Aug 2013 19:47:08 -0600
Some Nagios /tmp vulns (no reply from upstream)

Source: CCN
Type: IBM Security Bulletin T1024264 (PowerKVM)
Vulnerabilities in nagios affect PowerKVM

Source: CCN
Type: IBM Security Bulletin T1026031 (PowerKVM)
Vulnerabilities in nagios affect PowerKVM

Source: CCN
Type: BID-61747
Nagios CVE-2013-4214 Insecure Temporary File Creation Vulnerability

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: CCN
Type: Red Hat Bugzilla Bug 958002
CVE-2013-4214 Nagios core: html/rss-newsfeed.php insecure temporary file usage

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: XF
Type: UNKNOWN
nagios-cve20134214-symlink(86320)

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Vulnerable Configuration:Configuration CCN 1:
  • cpe:/a:nagios:nagios:3.4.4:*:*:*:*:*:*:*
  • AND
  • cpe:/a:ibm:powerkvm:2.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:powerkvm:3.1:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:113010
    P
    		nagios-4.4.6-2.5 on GA media (Moderate)
    2022-01-17
    oval:org.opensuse.security:def:106456
    P
    		Security update for ruby2.5 (Important)
    2021-12-01
    oval:com.ubuntu.precise:def:20134214000
    V
    		CVE-2013-4214 on Ubuntu 12.04 LTS (precise) - low.
    2013-11-23
    BACK
    nagios nagios 3.4.4
    ibm powerkvm 2.1
    ibm powerkvm 3.1