PT-2014-8773 · Nagios Icinga · Check Diskio Plugin

Published 2014-11-28 · Updated 2017-09-08 · CVE-2014-8994

Positive Technologies (AI Summary)

CVSS v2.0

3.6

Low

Base vector

AV:L/AC:L/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions Nagios and Icinga check diskio plugin versions 3.2.6 and earlier

Description The issue allows local users to write to arbitrary files via a symlink attack on a temporary file with a predictable name, specifically targeting the tmp/check diskio status-- file.

Recommendations For check diskio plugin versions 3.2.6 and earlier, consider restricting access to the temporary files used by the plugin to prevent symlink attacks until a patch is available.

Fix

Weakness Enumeration

CWE-18

Related Identifiers

CVE-2014-8994

Affected Products

Check Diskio Plugin

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2014-8994 · Security Note
• http://seclists.org/oss-sec/2014/q4/679 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/98849 · Note
• http://securityfocus.com/bid/71208 · Note
• http://seclists.org/oss-sec/2014/q4/701 · Note