CVEvulnerability
CVE-2016-8641
7.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2018-08-01
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 6.7 MEDIUM — CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
- CVSS 3.0 ([email protected])
- 7.8 HIGH — CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 7.2 HIGH — AV:L/AC:L/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-59
Description
A privilege escalation vulnerability was found in nagios 4.2.x that occurs in daemon-init.in when creating necessary files and insecurely changing the ownership afterwards. It's possible for the local attacker to create symbolic links before the files are to be created and possibly escalating the privileges with the ownership change.
Affected configurations
• nagios nagios 4.2.0
• nagios nagios 4.2.1
• nagios nagios 4.2.2
• nagios nagios 4.2.3
Related
Weakness · CWE (1)
- CWE-59 Improper Link Resolution Before File Access weakness
References
- http://www.securityfocus.com/bid/95121 Third Party Advisory, VDB Entry
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8641 Issue Tracking, Patch, Third Party Advisory
- https://github.com/NagiosEnterprises/nagioscore/commit/f2ed227673d3b2da643eb5cad26b2d87674f28c1.patch Patch, Third Party Advisory
- https://security.gentoo.org/glsa/201702-26 Third Party Advisory
- https://www.exploit-db.com/exploits/40774/ Exploit, Third Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/95121 Third Party Advisory, VDB Entry
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8641 Issue Tracking, Patch, Third Party Advisory
- https://github.com/NagiosEnterprises/nagioscore/commit/f2ed227673d3b2da643eb5cad26b2d87674f28c1.patch Patch, Third Party Advisory
- https://security.gentoo.org/glsa/201702-26 Third Party Advisory
- https://www.exploit-db.com/exploits/40774/ Exploit, Third Party Advisory, VDB Entry