Vulnerability Name:

CVE-2016-1247 (CCN-118408)

Assigned:2015-12-27
Published:2016-10-25
Updated:2021-12-14
Summary:The nginx package before 1.6.2-5+deb8u3 on Debian jessie, the nginx packages before 1.4.6-1ubuntu3.6 on Ubuntu 14.04 LTS, before 1.10.0-0ubuntu0.16.04.3 on Ubuntu 16.04 LTS, and before 1.10.1-0ubuntu1.1 on Ubuntu 16.10, and the nginx ebuild before 1.10.2-r3 on Gentoo allow local users with access to the web server user account to gain root privileges via a symlink attack on the error log.
CVSS v3 Severity:7.8 High (CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
6.8 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
8.4 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
7.3 High (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
CVSS v2 Severity:7.2 High (CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
7.2 High (CCN CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
Vulnerability Type:CWE-59
Vulnerability Consequences:Gain Privileges
References:Source: MITRE
Type: CNA
CVE-2016-1247

Source: MISC
Type: Exploit, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/139750/Nginx-Debian-Based-Distros-Root-Privilege-Escalation.html

Source: FULLDISC
Type: Mailing List, Third Party Advisory
20161116 Nginx (Debian-based distros) - Root Privilege Escalation Vulnerability (CVE-2016-1247)

Source: FULLDISC
Type: Mailing List, Third Party Advisory
20170113 Nginx (Debian-based + Gentoo distros) - Root Privilege Escalation [CVE-2016-1247 UPDATE]

Source: CCN
Type: SECTRACK ID: 1037104
nginx on Debian Log File Permissions Let Local Users Gain Elevated Privileges

Source: DEBIAN
Type: Vendor Advisory
DSA-3701

Source: BUGTRAQ
Type: Third Party Advisory, VDB Entry
20161121 Nginx (Debian-based distros) - Root Privilege Escalation (CVE-2016-1247)

Source: BID
Type: Third Party Advisory, VDB Entry
93903

Source: CCN
Type: BID-93903
Nginx CVE-2016-1247 Remote Privilege Escalation Vulnerability

Source: SECTRACK
Type: Third Party Advisory, VDB Entry
1037104

Source: UBUNTU
Type: Vendor Advisory
USN-3114-1

Source: XF
Type: UNKNOWN
debian-nginx-cve20161247-priv-esc(118408)

Source: MISC
Type: Exploit, Third Party Advisory
https://legalhackers.com/advisories/Nginx-Exploit-Deb-Root-PrivEsc-CVE-2016-1247.html

Source: FEDORA
Type: Mailing List, Third Party Advisory
FEDORA-2021-3aa9ac7fd1

Source: FEDORA
Type: Mailing List, Third Party Advisory
FEDORA-2021-1556d440ba

Source: FEDORA
Type: Mailing List, Third Party Advisory
FEDORA-2021-10c1cd4cba

Source: CCN
Type: Packet Storm Security [11-16-2016]
Nginx (Debian-Based Distros) Root Privilege Escalation

Source: GENTOO
Type: Third Party Advisory
GLSA-201701-22

Source: CCN
Type: Debian Security Advisory DSA-3701-1
nginx -- security update

Source: EXPLOIT-DB
Type: EXPLOIT
Offensive Security Exploit Database [11-16-2016]

Source: EXPLOIT-DB
Type: Exploit, Third Party Advisory, VDB Entry
40768

Source: CCN
Type: WhiteSource Vulnerability Database
CVE-2016-1247

Source: MISC
Type: Exploit, Third Party Advisory
https://www.youtube.com/watch?v=aTswN1k1fQs

Vulnerable Configuration:Configuration 1:
  • cpe:/a:f5:nginx:*:*:*:*:*:*:*:* (Version <= 1.10.1)
  • AND
  • cpe:/o:canonical:ubuntu_linux:16.10:*:*:*:*:*:*:*

    • Configuration 2:
  • cpe:/a:f5:nginx:*:*:*:*:*:*:*:* (Version <= 1.10.0)
  • AND
  • cpe:/o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*

    • Configuration 3:
  • cpe:/a:f5:nginx:*:*:*:*:*:*:*:* (Version <= 1.6.2)
  • AND
  • cpe:/o:debian:debian_linux:8.0:*:*:*:*:*:*:*

    • Configuration 4:
  • cpe:/a:f5:nginx:*:*:*:*:*:*:*:* (Version <= 1.4.3)
  • AND
  • cpe:/o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*

    • Configuration 5:
  • cpe:/o:fedoraproject:fedora:33:*:*:*:*:*:*:*
  • OR cpe:/o:fedoraproject:fedora:34:*:*:*:*:*:*:*
  • OR cpe:/o:fedoraproject:fedora:35:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:113396
    P
    		ruby2.7-rubygem-passenger-6.0.8-3.2 on GA media (Moderate)
    2022-01-17
    oval:org.opensuse.security:def:106801
    P
    		Security update for libsndfile (Important)
    2022-01-11
    oval:org.cisecurity:def:1342
    P
    		DSA-3701-1 -- nginx -- security update
    2016-12-09
    oval:org.cisecurity:def:1335
    P
    		DSA-3701-2 -- nginx -- security update
    2016-12-09
    oval:com.ubuntu.precise:def:20161247000
    V
    		CVE-2016-1247 on Ubuntu 12.04 LTS (precise) - medium.
    2016-11-29
    oval:com.ubuntu.trusty:def:20161247000
    V
    		CVE-2016-1247 on Ubuntu 14.04 LTS (trusty) - medium.
    2016-11-29
    oval:com.ubuntu.xenial:def:201612470000000
    V
    		CVE-2016-1247 on Ubuntu 16.04 LTS (xenial) - medium.
    2016-11-29
    oval:com.ubuntu.xenial:def:20161247000
    V
    		CVE-2016-1247 on Ubuntu 16.04 LTS (xenial) - medium.
    2016-11-29
    BACK
    f5 nginx *
    canonical ubuntu linux 16.10
    f5 nginx *
    canonical ubuntu linux 16.04
    f5 nginx *
    debian debian linux 8.0
    f5 nginx *
    canonical ubuntu linux 14.04
    fedoraproject fedora 33
    fedoraproject fedora 34
    fedoraproject fedora 35