CVE-2017-12847 (published 2017-08-23T21:29Z)

Nagios Core before 4.3.3 creates a nagios.lock PID file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for nagios.lock modification before a root script executes a "kill `cat /pathname/nagios.lock`" command.

Severity: MEDIUM
CVSS v2 base score: 6.3 (AV:L/AC:M/Au:N/C:N/I:C/A:C)
CVSS v3 base score: 6.3, MEDIUM (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H)

Weakness information:
cwe_id: CWE-665
cwe_name: Improper Initialization
description: The product does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used.
extended_description: This can have security implications when the associated resource is expected to have certain properties or values, such as a variable that determines whether a user has been authenticated or not.
         

Fix information:
repo_url: https://github.com/NagiosEnterprises/nagioscore
commit_details: repo_url: https://github.com/NagiosEnterprises/nagioscore
author: Michael Orlitzky
author_date: 2017-08-04 11:19:21-04:00
msg: configure.ac: use /run/nagios.lock as the default lockfile path.

The previous default path for the lockfile was located in
$localstatedir, which is generally writable by the nagios user. That
presents a security risk, since the nagios user can delete the
lockfile and replace it with another file containing the PID of a
root-owned process. This commit changes the default lockfile path to
/run/nagios.lock, and completes the fix for Github issue #404.
repository: repo_url: https://github.com/NagiosEnterprises/nagioscore
repo_name: NagiosEnterprises/nagioscore
description: Nagios Core
repo_language: C
owner: NagiosEnterprises
file_changes: filename: configure.ac
change_type: ModificationType.MODIFY
diff: @@ -267,9 +267,9 @@ AC_SUBST(init_dir)
 dnl User can override lock file location
 AC_ARG_WITH(lockfile,
 	AC_HELP_STRING([--with-lockfile=<path>],
-		[sets path and file name for lock file]),
+		[sets path for lock file (default: /run/nagios.lock)]),
 	lockfile=$withval,
-	lockfile=$localstatedir/nagios.lock
+	lockfile=/run/nagios.lock
 )
 AC_SUBST(lockfile)
 

programming_language: Shell
repo_url: https://github.com/NagiosEnterprises/nagioscore
commit_details: repo_url: https://github.com/NagiosEnterprises/nagioscore
author: Bryan Heden
author_date: 2017-07-30 16:28:11-05:00
msg: halfway revert hack/configure changes - switch order of daemon_init/drop_privileges
repository: repo_url: https://github.com/NagiosEnterprises/nagioscore
repo_name: NagiosEnterprises/nagioscore
description: Nagios Core
repo_language: C
owner: NagiosEnterprises
file_changes: filename: Changelog
change_type: ModificationType.MODIFY
diff: @@ -8,6 +8,8 @@ Nagios Core 4 Change Log
 * On-demand host check always use cached host state (John Frickson)
 * 'á' causes Serivce Status Information to not be displayed (John Frickson)
 * New Macro(s) to generate URL for host / service object (John Frickson)
+* Fix minor map issues (Troy Lea)
+* Fix lockfile issues (Bryan Heden)
 
 
 4.3.2 - 2017-05-09

programming_language: Markdown
filename: THANKS
change_type: ModificationType.MODIFY
diff: @@ -320,6 +320,7 @@ wrong, please let me know.
 * Tomer Okavi
 * Ton Voon
 * Torsten Huebler
+* Troy Lea
 * Tyler Lund
 * Uwe Knop
 * Uwe Knop

programming_language: Markdown
filename: nagios.c
change_type: ModificationType.MODIFY
diff: @@ -592,6 +592,22 @@ int main(int argc, char **argv) {
 			program_start = time(NULL);
 			my_free(mac->x[MACRO_PROCESSSTARTTIME]);
 			asprintf(&mac->x[MACRO_PROCESSSTARTTIME], "%llu", (unsigned long long)program_start);
+			
+			/* enter daemon mode (unless we're restarting...) */
+			if(daemon_mode == TRUE && sigrestart == FALSE) {
+
+				result = daemon_init();
+
+				/* we had an error daemonizing, so bail... */
+				if(result == ERROR) {
+					logit(NSLOG_PROCESS_INFO | NSLOG_RUNTIME_ERROR, TRUE, "Bailing out due to failure to daemonize. (PID=%d)", (int)getpid());
+					cleanup();
+					exit(EXIT_FAILURE);
+					}
+
+				/* get new PID */
+				nagios_pid = (int)getpid();
+				}
 
 			/* drop privileges */
 			if(drop_privileges(nagios_user, nagios_group) == ERROR) {
@@ -612,21 +628,6 @@ int main(int argc, char **argv) {
 				/* error has already been logged */
 				exit(EXIT_FAILURE);
 				}
-			/* enter daemon mode (unless we're restarting...) */
-			if(daemon_mode == TRUE && sigrestart == FALSE) {
-
-				result = daemon_init();
-
-				/* we had an error daemonizing, so bail... */
-				if(result == ERROR) {
-					logit(NSLOG_PROCESS_INFO | NSLOG_RUNTIME_ERROR, TRUE, "Bailing out due to failure to daemonize. (PID=%d)", (int)getpid());
-					cleanup();
-					exit(EXIT_FAILURE);
-					}
-
-				/* get new PID */
-				nagios_pid = (int)getpid();
-				}
 
 			/* this must be logged after we read config data, as user may have changed location of main log file */
 			logit(NSLOG_PROCESS_INFO, TRUE, "Nagios %s starting... (PID=%d)\n", PROGRAM_VERSION, (int)getpid());

programming_language: C
filename: configure.ac
change_type: ModificationType.MODIFY
diff: @@ -227,6 +227,7 @@ AC_ARG_WITH(checkresult-dir,
 if test x$CHECKRESULTDIR = xno; then
 	CHECKRESULTDIR="$localstatedir/spool/checkresults"
 fi 
+AC_SUBST(CHECKRESULTDIR)
 
 dnl Location of check result path
 TMPDIR=no
@@ -270,7 +271,7 @@ AC_ARG_WITH(lockfile,
 	lockfile=$withval,
 	lockfile=$localstatedir/nagios.lock
 )
-
+AC_SUBST(lockfile)
 
 dnl Determine the library to be used by the iobroker
 
@@ -819,13 +820,6 @@ perl subst sample-config/template-object/printer.cfg
 perl subst sample-config/template-object/switch.cfg
 
 
-
-eval localstatedir=$localstatedir
-eval lockfile=$lockfile
-eval CHECKRESULTDIR=$CHECKRESULTDIR
-AC_SUBST(CHECKRESULTDIR)
-AC_SUBST(lockfile)
-
 dnl Review options
 echo ""
 echo ""

programming_language: Shell