CVE-2016-8641 Privilege escalation in nagios

Medium 6.7 Published 1 Aug 2018 Updated 6 Aug 2024

Local attackers can escalate privileges by exploiting insecure file ownership changes during daemon initialization via symbolic link attacks.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2016-8641?

CVE-2016-8641 is a medium-severity vulnerability in nagios, published on 1 Aug 2018. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

A privilege escalation vulnerability was found in nagios 4.2.x that occurs in daemon-init.in when creating necessary files and insecurely changing the ownership afterwards. It's possible for the local attacker to create symbolic links before the files are to be created and possibly escalating the privileges with the ownership change.

Weakness: CWE-59

Which versions are affected by CVE-2016-8641?

It affects 1 product.

Products include Nagios Nagios.

How do I fix CVE-2016-8641?

Apply the vendor's patch.

Is CVE-2016-8641 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2016-8641 exists.

Public exploit code: 1 Exploit-DB entry.

Sources

Also known as GHSA-xh33-x4fq-3r2h.