CVE-2016-8641: Improper Link Resolution Before File Access ('Link Following') (CWE-59)
value: A privilege escalation vulnerability was found in nagios 4.2.x that occurs in daemon-init.in when creating necessary files and insecurely changing the ownership afterwards. It's possible for the local attacker to create symbolic links before the files are to be created and possibly escalating the privileges with the ownership change.
CWE description: The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
CVSS v3 base score: 7.8
Published: 2018-08-01T14:29Z
Repository: https://github.com/NagiosEnterprises/nagioscore
Language: Other
Files changed: Changelog, daemon-init.in
Commit date: 2016-11-09 15:16:55 -0600
Commit message: root privilege escalation fix

Diff: diff --git a/Changelog b/Changelog
index 410e250c..4a304ff3 100644
--- a/Changelog
+++ b/Changelog
@@ -3,10 +3,13 @@ Nagios Core 4 Change Log
 ########################
 
 
 4.2.x - xxxx-xx-xx
 -------------------
+SECURITY FIXES
+* Fixed a root privilege escalation
+
 FIXES
 * external command during reload doesn't work (John Frickson)
 * Nagios provides no error condition as to why it fails on the verify for serviceescalation (John Frickson)
 * No root group in FreeBSD and Apple OS X (John Frickson)
 * jsonquery.html doesn't display scheduled_time_ok correctly (John Frickson)
@@ -17,11 +20,11 @@ FIXES
 * HOSTSTATEID returns 0 even if host does not exist (John Frickson)
 * Submitting UNREACHABLE passive result for host sets it as DOWN if the host has no parents (John Frickson)
 * nagios: job XX (pid=YY): read() returned error 11 (changed from LOG_ERR to LOG_NOTICE) (John Frickson)
 
 
-4.2.2 - 2016-10-xx
+4.2.2 - 2016-10-24
 ------------------
 SECURITY FIXES
 * There was a fix to vulnerability CVE-2008-4796 in the 4.2.0 release on
   August 1, 2016. The fix was apparently incomplete, as there was still a
   problem. However, we are now getting all RSS feeds using AJAX calls
diff --git a/daemon-init.in b/daemon-init.in
index 3a2ffee2..fd637645 100644
--- a/daemon-init.in
+++ b/daemon-init.in
@@ -77,11 +77,11 @@ if test "$USE_RAMDISK" -ne 0 && test "$RAMDISK_SIZE"X != "X"; then
 	ramdisk=`mount |grep "${RAMDISK_DIR} type tmpfs"`
 	if [ "$ramdisk"X == "X" ]; then
 		mkdir -p -m 0755 ${RAMDISK_DIR}
 		mount -t tmpfs -o size=${RAMDISK_SIZE}m tmpfs ${RAMDISK_DIR}
 		mkdir -p -m 0755 ${RAMDISK_DIR}/checkresults
-		chown -R $NagiosUser:$NagiosGroup ${RAMDISK_DIR}
+		chown -h -R $NagiosUser:$NagiosGroup ${RAMDISK_DIR}
 	fi
 fi
 
 
 check_config ()
@@ -89,30 +89,36 @@ check_config ()
 	TMPFILE=$(mktemp /tmp/.configtest.XXXXXXXX)
 	$NagiosBin -vp $NagiosCfgFile > "$TMPFILE"
 	WARN=`grep ^"Total Warnings:" "$TMPFILE" |awk -F: '{print \$2}' |sed s/' '//g`
 	ERR=`grep ^"Total Errors:" "$TMPFILE" |awk -F: '{print \$2}' |sed s/' '//g`
 
+	rm -f "$NagiosCfgtestFile";
+	if test -e "$NagiosCfgtestFile"; then
+		echo "ERROR: Could not delete '$NagiosCfgtestFile'"
+		exit 8
+	fi
+
 	if test "$WARN" = "0" && test "${ERR}" = "0"; then
 		echo "OK - Configuration check verified" > $NagiosCfgtestFile
 		chmod 0644 $NagiosCfgtestFile
-		chown $NagiosUser:$NagiosGroup $NagiosCfgtestFile
+		chown -h $NagiosUser:$NagiosGroup $NagiosCfgtestFile
 		/bin/rm "$TMPFILE"
 		return 0
 	elif test "${ERR}" = "0"; then
 		# Write the errors to a file we can have a script watching for.
 		echo "WARNING: Warnings in config files - see log for details: $NagiosCfgtestFile" > $NagiosCfgtestFile
 		egrep -i "(^warning|^error)" "$TMPFILE" >> $NagiosCfgtestFile
 		chmod 0644 $NagiosCfgtestFile
-		chown $NagiosUser:$NagiosGroup $NagiosCfgtestFile
+		chown -h $NagiosUser:$NagiosGroup $NagiosCfgtestFile
 		/bin/rm "$TMPFILE"
 		return 0
 	else
 		# Write the errors to a file we can have a script watching for.
 		echo "ERROR: Errors in config files - see log for details: $NagiosCfgtestFile" > $NagiosCfgtestFile
 		egrep -i "(^warning|^error)" "$TMPFILE" >> $NagiosCfgtestFile
 		chmod 0644 $NagiosCfgtestFile
-		chown $NagiosUser:$NagiosGroup $NagiosCfgtestFile
+		chown -h $NagiosUser:$NagiosGroup $NagiosCfgtestFile
 		cat "$TMPFILE"
 		exit 8
 	fi
 }
 
@@ -186,11 +192,11 @@ case "$1" in
 		fi
 
 		touch $NagiosVarDir/nagios.log $NagiosRetentionFile
 		rm -f $NagiosCommandFile
 		touch $NagiosRunFile
-		chown $NagiosUser:$NagiosGroup $NagiosRunFile $NagiosVarDir/nagios.log $NagiosRetentionFile
+		chown -h $NagiosUser:$NagiosGroup $NagiosRunFile $NagiosVarDir/nagios.log $NagiosRetentionFile
 		$NagiosBin -d $NagiosCfgFile
 		if [ -d $NagiosLockDir ]; then touch $NagiosLockDir/$NagiosLockFile; fi
 
 		echo " done."
 		;;

Vulnerable code: 4.2.2 - 2016-10-xx
		chown -R $NagiosUser:$NagiosGroup ${RAMDISK_DIR}
		chown $NagiosUser:$NagiosGroup $NagiosCfgtestFile
		chown $NagiosUser:$NagiosGroup $NagiosCfgtestFile
		chown $NagiosUser:$NagiosGroup $NagiosCfgtestFile
		chown $NagiosUser:$NagiosGroup $NagiosRunFile $NagiosVarDir/nagios.log $NagiosRetentionFile
Fixed code: SECURITY FIXES
* Fixed a root privilege escalation

4.2.2 - 2016-10-24
		chown -h -R $NagiosUser:$NagiosGroup ${RAMDISK_DIR}
	rm -f "$NagiosCfgtestFile";
	if test -e "$NagiosCfgtestFile"; then
		echo "ERROR: Could not delete '$NagiosCfgtestFile'"
		exit 8
	fi

		chown -h $NagiosUser:$NagiosGroup $NagiosCfgtestFile
		chown -h $NagiosUser:$NagiosGroup $NagiosCfgtestFile
		chown -h $NagiosUser:$NagiosGroup $NagiosCfgtestFile
		chown -h $NagiosUser:$NagiosGroup $NagiosRunFile $NagiosVarDir/nagios.log $NagiosRetentionFile