VDB

CVE-2016-8641

CVE-2016-8641 PUBLISHED CVSS 6.7 MEDIUM

Reported by redhat · Published August 1, 2018

A privilege escalation vulnerability was found in nagios 4.2.x that occurs in daemon-init.in when creating necessary files and insecurely changing the ownership afterwards. It's possible for the local attacker to create symbolic links before the files are to be created and possibly escalating the privileges with the ownership change.

Risk Scores

CVSS 3.0
6.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Affected Products

VendorProductVersions
Nagios Enterprisesnagios4.2.x
Nagios Enterprisesnagios4.2.x, 4.2.x, 4.2.x

Timeline

  • Nov 18, 2016 PoC Published
  • Aug 1, 2018 CVE Published
  • Feb 4, 2022 EPSS Score
  • Mar 29, 2022 EPSS Score
  • May 22, 2022 EPSS Score
  • Jul 15, 2022 EPSS Score
  • Sep 7, 2022 EPSS Score
  • Oct 30, 2022 EPSS Score
  • Dec 22, 2022 EPSS Score
  • Feb 14, 2023 EPSS Score
  • Apr 8, 2023 EPSS Score
  • May 31, 2023 EPSS Score

References

  • 40774 exploitx_refsource_EXPLOIT-DB
  • x_refsource_CONFIRM
  • x_refsource_CONFIRM
  • 95121 vdb-entryx_refsource_BID
  • GLSA-201702-26 vendor-advisoryx_refsource_GENTOO
Open in Interactive Console →
$ Console Community · 50/day Open console ›