Category Archives: Nagios

Nagios

CVE-2017-12847

Nagios Core before 4.3.3 creates a nagios.lock PID file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for nagios.lock modification before a root script executes a “kill `cat /pathname/nagios.lock`” command. (CVSS:6.3) (Last Update:2017-09-01)

Read more

CVE-2016-0726

The Fedora Nagios package uses “nagiosadmin” as the default password for the “nagiosadmin” administrator account, which makes it easier for remote attackers to obtain access by leveraging knowledge of the credentials. (CVSS:7.5) (Last Update:2017-06-22)

Read more

CVE-2016-9565

MagpieRSS, as used in the front-end component in Nagios Core before 4.2.2 might allow remote attackers to read or write to arbitrary files by spoofing a crafted response from the Nagios RSS feed server. NOTE: this vulnerability exists because of an incomplete fix for CVE-2008-4796. (CVSS:7.5) (Last Update:2016-12-16)

Read more

CVE-2016-9566

base/logging.c in Nagios Core before 4.2.4 allows local users with access to an account in the nagios group to gain root privileges via a symlink attack on the log file. NOTE: this can be leveraged by remote attackers using CVE-2016-9565. (CVSS:7.2) (Last Update:2016-12-16)

Read more