VDB

CVE-2016-8641

CVE-2016-8641 PUBLISHED CVSS 6.7 MEDIUM

Reported by redhat · Published August 1, 2018

A privilege escalation vulnerability was found in nagios 4.2.x that occurs in daemon-init.in when creating necessary files and insecurely changing the ownership afterwards. It's possible for the local attacker to create symbolic links before the files are to be created and possibly escalating the privileges with the ownership change.

Risk Scores

CVSS 3.0
6.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Affected Products

VendorProductVersions
Nagios Enterprisesnagios4.2.x
Nagios Enterprisesnagios4.2.x, 4.2.x

Timeline

  • Nov 18, 2016 PoC Published
  • Aug 1, 2018 CVE Published
  • Feb 4, 2022 EPSS Score
  • Mar 29, 2022 EPSS Score
  • May 20, 2022 EPSS Score
  • Jul 12, 2022 EPSS Score
  • Sep 3, 2022 EPSS Score
  • Oct 26, 2022 EPSS Score
  • Dec 18, 2022 EPSS Score
  • Feb 8, 2023 EPSS Score
  • Apr 2, 2023 EPSS Score
  • May 25, 2023 EPSS Score

References

  • 40774 exploitx_refsource_EXPLOIT-DB
  • x_refsource_CONFIRM
  • x_refsource_CONFIRM
  • 95121 vdb-entryx_refsource_BID
  • GLSA-201702-26 vendor-advisoryx_refsource_GENTOO
Open in Interactive Console →
$ Console Community · 100/wk Open console ›