PT-2017-13383 · Nagios · Nagios Core

Orlitzky · Publicado 2017-09-11 · Atualizado 2019-10-03 · CVE-2017-14312

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Nagios Core versions prior to 4.4

Description The issue allows local users to gain privileges by leveraging access to a non-root account that owns certain configuration files or the executable. This is possible because Nagios Core initially executes as root but supports configuration options where key files are owned by non-root accounts.

Recommendations For Nagios Core versions prior to 4.4, consider restricting access to the configuration files and executable to prevent local users from exploiting this issue. As a temporary workaround, ensure that all files related to Nagios Core are owned by a root account to minimize the risk of exploitation.

Correção

Improper Privilege Management

Enumeração de Fraquezas

CWE-269

Identificadores relacionados

CVE-2017-14312

Produtos afetados

Nagios Core

Referências · 5

• https://github.com/NagiosEnterprises/nagioscore/issues/424 · Nota
• http://securityfocus.com/bid/100881 · Nota
• https://security.gentoo.org/glsa/201812-03 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-14312 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-14312 · Nota de Segurança