PT-2014-6066 · Nagios · Nagios Plugins

Published 2014-12-05 · Updated 2016-11-28 · CVE-2014-4703

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Nagios Plugins version 2.0.2

Description The issue allows local users to obtain sensitive information via a symlink attack on the configuration file in the extra-opts flag. This problem exists due to an incomplete fix for a previous issue.

Recommendations For Nagios Plugins version 2.0.2, consider updating to a newer version that fully addresses the incomplete fix, or as a temporary workaround, restrict access to the configuration file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

CVE-2014-4703

Affected Products

Nagios Plugins

References · 6

• 🔥 http://seclists.org/fulldisclosure/2014/Jun/141 · Exploit
• 🔥 https://exploit-db.com/exploits/33904 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-4703 · Security Note
• http://nagios-plugins.org/nagios-plugins-2-0-3-released · Vendor Advisory
• http://openwall.com/lists/oss-security/2014/06/30/6 · Note
• http://securityfocus.com/bid/76810 · Note