CVE-2016-8641 (published 2018-08-01T14:29Z)

A privilege escalation vulnerability was found in nagios 4.2.x that occurs in daemon-init.in when creating necessary files and insecurely changing the ownership afterwards. It's possible for the local attacker to create symbolic links before the files are to be created and possibly escalating the privileges with the ownership change.

Severity: HIGH
CVSS v2 base score: 7.2 (AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v3 base score: 7.8, HIGH (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-59
cwe_name: Improper Link Resolution Before File Access ('Link Following')
description: The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/NagiosEnterprises/nagioscore
commit_details: repo_url: https://github.com/NagiosEnterprises/nagioscore
author: John C. Frickson
author_date: 2016-11-09 15:16:55-06:00
msg: root privilege escalation fix
repository: repo_url: https://github.com/NagiosEnterprises/nagioscore
repo_name: NagiosEnterprises/nagioscore
description: Nagios Core
repo_language: C
owner: NagiosEnterprises
file_changes: filename: Changelog
change_type: ModificationType.MODIFY
diff: @@ -5,6 +5,9 @@ Nagios Core 4 Change Log
 
 4.2.x - xxxx-xx-xx
 -------------------
+SECURITY FIXES
+* Fixed a root privilege escalation
+
 FIXES
 * external command during reload doesn't work (John Frickson)
 * Nagios provides no error condition as to why it fails on the verify for serviceescalation (John Frickson)
@@ -19,7 +22,7 @@ FIXES
 * nagios: job XX (pid=YY): read() returned error 11 (changed from LOG_ERR to LOG_NOTICE) (John Frickson)
 
 
-4.2.2 - 2016-10-xx
+4.2.2 - 2016-10-24
 ------------------
 SECURITY FIXES
 * There was a fix to vulnerability CVE-2008-4796 in the 4.2.0 release on

programming_language: Markdown
filename: daemon-init.in
change_type: ModificationType.MODIFY
diff: @@ -79,7 +79,7 @@ if test "$USE_RAMDISK" -ne 0 && test "$RAMDISK_SIZE"X != "X"; then
 		mkdir -p -m 0755 ${RAMDISK_DIR}
 		mount -t tmpfs -o size=${RAMDISK_SIZE}m tmpfs ${RAMDISK_DIR}
 		mkdir -p -m 0755 ${RAMDISK_DIR}/checkresults
-		chown -R $NagiosUser:$NagiosGroup ${RAMDISK_DIR}
+		chown -h -R $NagiosUser:$NagiosGroup ${RAMDISK_DIR}
 	fi
 fi
 
@@ -91,10 +91,16 @@ check_config ()
 	WARN=`grep ^"Total Warnings:" "$TMPFILE" |awk -F: '{print \$2}' |sed s/' '//g`
 	ERR=`grep ^"Total Errors:" "$TMPFILE" |awk -F: '{print \$2}' |sed s/' '//g`
 
+	rm -f "$NagiosCfgtestFile";
+	if test -e "$NagiosCfgtestFile"; then
+		echo "ERROR: Could not delete '$NagiosCfgtestFile'"
+		exit 8
+	fi
+
 	if test "$WARN" = "0" && test "${ERR}" = "0"; then
 		echo "OK - Configuration check verified" > $NagiosCfgtestFile
 		chmod 0644 $NagiosCfgtestFile
-		chown $NagiosUser:$NagiosGroup $NagiosCfgtestFile
+		chown -h $NagiosUser:$NagiosGroup $NagiosCfgtestFile
 		/bin/rm "$TMPFILE"
 		return 0
 	elif test "${ERR}" = "0"; then
@@ -102,7 +108,7 @@ check_config ()
 		echo "WARNING: Warnings in config files - see log for details: $NagiosCfgtestFile" > $NagiosCfgtestFile
 		egrep -i "(^warning|^error)" "$TMPFILE" >> $NagiosCfgtestFile
 		chmod 0644 $NagiosCfgtestFile
-		chown $NagiosUser:$NagiosGroup $NagiosCfgtestFile
+		chown -h $NagiosUser:$NagiosGroup $NagiosCfgtestFile
 		/bin/rm "$TMPFILE"
 		return 0
 	else
@@ -110,7 +116,7 @@ check_config ()
 		echo "ERROR: Errors in config files - see log for details: $NagiosCfgtestFile" > $NagiosCfgtestFile
 		egrep -i "(^warning|^error)" "$TMPFILE" >> $NagiosCfgtestFile
 		chmod 0644 $NagiosCfgtestFile
-		chown $NagiosUser:$NagiosGroup $NagiosCfgtestFile
+		chown -h $NagiosUser:$NagiosGroup $NagiosCfgtestFile
 		cat "$TMPFILE"
 		exit 8
 	fi
@@ -188,7 +194,7 @@ case "$1" in
 		touch $NagiosVarDir/nagios.log $NagiosRetentionFile
 		rm -f $NagiosCommandFile
 		touch $NagiosRunFile
-		chown $NagiosUser:$NagiosGroup $NagiosRunFile $NagiosVarDir/nagios.log $NagiosRetentionFile
+		chown -h $NagiosUser:$NagiosGroup $NagiosRunFile $NagiosVarDir/nagios.log $NagiosRetentionFile
 		$NagiosBin -d $NagiosCfgFile
 		if [ -d $NagiosLockDir ]; then touch $NagiosLockDir/$NagiosLockFile; fi
 

programming_language: Shell