PT-2017-13383 · Nagios · Nagios Core

Orlitzky · Published 2017-09-11 · Updated 2019-10-03 · CVE-2017-14312

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Nagios Core versions prior to 4.4

Description The issue allows local users to gain privileges by leveraging access to a non-root account that owns certain configuration files or the executable. This is possible because Nagios Core initially executes as root but supports configuration options where key files are owned by non-root accounts.

Recommendations For Nagios Core versions prior to 4.4, consider restricting access to the configuration files and executable to prevent local users from exploiting this issue. As a temporary workaround, ensure that all files related to Nagios Core are owned by a root account to minimize the risk of exploitation.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2017-14312

Affected Products

Nagios Core

References · 5

• https://security.gentoo.org/glsa/201812-03 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-14312 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-14312 · Security Note
• https://github.com/NagiosEnterprises/nagioscore/issues/424 · Note
• http://securityfocus.com/bid/100881 · Note