| Vulnerability Name: | CVE-2016-9566 (CCN-119798) | ||||||||||||||||||||||||||||||||
| Assigned: | 2016-12-15 | ||||||||||||||||||||||||||||||||
| Published: | 2016-12-15 | ||||||||||||||||||||||||||||||||
| Updated: | 2018-12-25 | ||||||||||||||||||||||||||||||||
| Summary: | base/logging.c in Nagios Core before 4.2.4 allows local users with access to an account in the nagios group to gain root privileges via a symlink attack on the log file. Note: this can be leveraged by remote attackers using CVE-2016-9565. | ||||||||||||||||||||||||||||||||
| CVSS v3 Severity: | 7.8 High (CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) 7.0 High (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C)
7.0 High (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C)
| ||||||||||||||||||||||||||||||||
| CVSS v2 Severity: | 7.2 High (CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C)
| ||||||||||||||||||||||||||||||||
| Vulnerability Type: | CWE-59 CWE-264 | ||||||||||||||||||||||||||||||||
| Vulnerability Consequences: | Gain Privileges | ||||||||||||||||||||||||||||||||
| References: | Source: MITRE Type: CNA CVE-2016-9566 Source: CCN Type: RHSA-2017-0211 Important: nagios security update Source: REDHAT Type: UNKNOWN RHSA-2017:0211 Source: CCN Type: RHSA-2017-0212 Important: nagios security update Source: REDHAT Type: UNKNOWN RHSA-2017:0212 Source: CCN Type: RHSA-2017-0213 Important: nagios security update Source: REDHAT Type: UNKNOWN RHSA-2017:0213 Source: CCN Type: RHSA-2017-0214 Important: nagios security update Source: REDHAT Type: UNKNOWN RHSA-2017:0214 Source: CCN Type: RHSA-2017-0258 Important: nagios security update Source: REDHAT Type: UNKNOWN RHSA-2017:0258 Source: CCN Type: RHSA-2017-0259 Important: nagios security update Source: REDHAT Type: UNKNOWN RHSA-2017:0259 Source: CCN Type: Full-Disclosure Mailing List, Thu, 15 Dec 2016 07:24:27 -0200 Nagios Core < 4.2.4 Root Privilege Escalation [CVE-2016-9566] Source: FULLDISC Type: Mailing List, Third Party Advisory 20161215 Nagios Core < 4.2.4 Root Privilege Escalation [CVE-2016-9566] Source: CCN Type: IBM Security Bulletin T1024796 (PurePower Management Node) Vulnerabilities in Nagios Core affect IBM Pure Power Integrated Manager (PPIM) (CVE-2016-9565, CVE-2016-9566) Source: BID Type: Third Party Advisory, VDB Entry 94919 Source: CCN Type: BID-94919 Nagios CVE-2016-9566 Local Privilege Escalation Vulnerability Source: SECTRACK Type: UNKNOWN 1037487 Source: CONFIRM Type: Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=1402869 Source: XF Type: UNKNOWN nagios-core-cve20169566-pric-esc(119798) Source: CONFIRM Type: Issue Tracking, Patch https://github.com/NagiosEnterprises/nagioscore/commit/c29557dec91eba2306f5fb11b8da4474ba63f8c4 Source: MISC Type: Exploit, Third Party Advisory https://legalhackers.com/advisories/Nagios-Exploit-Root-PrivEsc-CVE-2016-9566.html Source: MLIST Type: UNKNOWN [debian-lts-announce] 20181224 [SECURITY] [DLA 1615-1] nagios3 security update Source: GENTOO Type: UNKNOWN GLSA-201612-51 Source: GENTOO Type: UNKNOWN GLSA-201702-26 Source: GENTOO Type: UNKNOWN GLSA-201710-20 Source: EXPLOIT-DB Type: EXPLOIT Offensive Security Exploit Database [12-15-2016] Source: EXPLOIT-DB Type: UNKNOWN 40921 Source: CCN Type: Nagios Web site The Industry Standard In IT Infrastructure Monitoring Source: CONFIRM Type: Vendor Advisory https://www.nagios.org/projects/nagios-core/history/4x/ Source: CCN Type: WhiteSource Vulnerability Database CVE-2016-9566 | ||||||||||||||||||||||||||||||||
| Vulnerable Configuration: | Configuration 1: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||||||||||||||||||||||||||
| Oval Definitions | |||||||||||||||||||||||||||||||||
| |||||||||||||||||||||||||||||||||
| BACK | |||||||||||||||||||||||||||||||||