← back
CVE-2016-9566

CVE-2016-9566

EPSS 4.9%
base/logging.c in Nagios Core before 4.2.4 allows local users with access to an account in the nagios group to gain root privileges via a symlink attack on the log file. NOTE: this can be leveraged by remote attackers using CVE-2016-9565.
Affected products
n/a · n/a
public PoCs found — 2
cve_referencewww.exploit-db.com/exploits/40921/unverifiedexploitdbwww.exploit-db.com/exploits/40921unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
http://rhn.redhat.com/errata/RHSA-2017-0211.htmlhttp://rhn.redhat.com/errata/RHSA-2017-0212.htmlhttp://rhn.redhat.com/errata/RHSA-2017-0213.htmlhttp://rhn.redhat.com/errata/RHSA-2017-0214.htmlhttp://rhn.redhat.com/errata/RHSA-2017-0258.htmlhttp://rhn.redhat.com/errata/RHSA-2017-0259.htmlhttps://bugzilla.redhat.com/show_bug.cgi?id=1402869http://seclists.org/fulldisclosure/2016/Dec/58https://github.com/NagiosEnterprises/nagioscore/commit/c29557dec91eba2306f5fb11b8da4474ba63f8c4https://legalhackers.com/advisories/Nagios-Exploit-Root-PrivEsc-CVE-2016-9566.htmlhttps://lists.debian.org/debian-lts-announce/2018/12/msg00014.htmlhttps://security.gentoo.org/glsa/201612-51