CVE-2019-3698 nagios cron job allows privilege escalation from user nagios to root
Local attackers can escalate privileges to root or cause denial of service by exploiting a race condition in the Nagios cron job symlink handling.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-3698?
CVE-2019-3698 is a medium-severity vulnerability in Opensuse Backports Sle, published on 28 Feb 2020. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
UNIX Symbolic Link (Symlink) Following vulnerability in the cronjob shipped with nagios of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 11; openSUSE Factory allows local attackers to cause cause DoS or potentially escalate privileges by winning a race. This issue affects: SUSE Linux Enterprise Server 12 nagios version 3.5.1-5.27 and prior versions. SUSE Linux Enterprise Server 11 nagios version 3.0.6-1.25.36.3.1 and prior versions. openSUSE Factory nagios version 4.4.5-2.1 and prior versions.
Weakness: CWE-59
Which versions are affected by CVE-2019-3698?
It affects 3 products.
Products include Nagios Nagios, Opensuse Backports Sle, Opensuse Leap.
How do I fix CVE-2019-3698?
Apply the vendor's patch.
Is CVE-2019-3698 being exploited?
There is no known exploitation of CVE-2019-3698 in the wild and no public exploit code.
Other vulnerabilities in Opensuse Backports Sle
Sources
Also known as GHSA-q8m8-7jgv-237q.