PT-2014-8773 · Nagios Icinga · Check Diskio Plugin

Publicado 2014-11-28 · Atualizado 2017-09-08 · CVE-2014-8994

Positive Technologies (AI Summary)

CVSS v2.0

3.6

Baixa

Vetor base

AV:L/AC:L/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions Nagios and Icinga check diskio plugin versions 3.2.6 and earlier

Description The issue allows local users to write to arbitrary files via a symlink attack on a temporary file with a predictable name, specifically targeting the tmp/check diskio status-- file.

Recommendations For check diskio plugin versions 3.2.6 and earlier, consider restricting access to the temporary files used by the plugin to prevent symlink attacks until a patch is available.

Correção

Enumeração de Fraquezas

CWE-18

Identificadores relacionados

CVE-2014-8994

Produtos afetados

Check Diskio Plugin

Referências · 5

• http://seclists.org/oss-sec/2014/q4/679 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/98849 · Nota
• http://securityfocus.com/bid/71208 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-8994 · Nota de Segurança
• http://seclists.org/oss-sec/2014/q4/701 · Nota