CVE-2017-16882 Privilege escalation in n/a
Local attackers can escalate privileges if Icinga binaries or configs are owned by non-root users, allowing execution as root.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-16882?
CVE-2017-16882 is a high-severity vulnerability in n/a, published on 18 Nov 2017. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Icinga Core through 1.14.0 initially executes bin/icinga as root but supports configuration options in which this file is owned by a non-root account (and similarly can have etc/icinga.cfg owned by a non-root account), which allows local users to gain privileges by leveraging access to this non-root account, a related issue to CVE-2017-14312. This also affects bin/icingastats, bin/ido2db, and bin/log2ido.
Weakness: CWE-732
Which versions are affected by CVE-2017-16882?
It affects 1 product.
Products include Icinga Icinga.
How do I fix CVE-2017-16882?
No fix has been published for CVE-2017-16882 yet. Limit exposure of the affected software until one is available.
Is CVE-2017-16882 being exploited?
There is no known exploitation of CVE-2017-16882 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2025-48057 Icinga 2 certificate renewal might incorrectly renew an invalid certificate
- CVE-2020-29663 Security feature bypass in n/a
- CVE-2024-24820 Icinga Director configuration is susceptible to Cross-Site Request Forgery
- CVE-2018-6535 Information disclosure in n/a
- CVE-2020-14004 Path traversal in n/a
Sources
Also known as GHSA-rc9c-mrhp-7jg8.