CVE-2016-9566

base/logging.c in Nagios Core before 4.2.4 allows local users with access to an account in the nagios group to gain root privileges via a symlink attack on the log file.  NOTE: this can be leveraged by remote attackers using CVE-2016-9565.
Link Following
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.8 HIGH
LOCAL
LOW
LOW
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 92%
Affected Products (NVD)
VendorProductVersion
nagiosnagios
𝑥
≤ 4.2.3
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
nagios3
precise
ignored
trusty
Fixed 3.5.1-1ubuntu1.1
released
xenial
Fixed 3.5.1.dfsg-2.1ubuntu1.1
released
yakkety
Fixed 3.5.1.dfsg-2.1ubuntu3.1
released
zesty
Fixed 3.5.1.dfsg-2.1ubuntu5
released
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
sysuser-shadow
suse enterprise server 12 SP3
2.0-1.9.1
fixed
suse enterprise server 12 SP5
2.0-1.9.1
fixed
sysuser-tools
suse enterprise server 12 SP3
2.0-1.9.1
fixed
suse enterprise server 12 SP5
2.0-1.9.1
fixed
References