Description
Nagios Core through 4.3.4 initially executes /usr/sbin/nagios as root but supports configuration options in which this file is owned by a non-root account (and similarly can have nagios.cfg owned by a non-root account), which allows local users to gain privileges by leveraging access to this non-root account.
References (3)
Core 3
Core References
Third Party Advisory vendor-advisory
x_refsource_gentoo
https://security.gentoo.org/glsa/201812-03
Issue Tracking, Third Party Advisory x_refsource_misc
https://github.com/NagiosEnterprises/nagioscore/issues/424
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/100881
Scores
CVSS v3
7.8
EPSS
0.0009
EPSS Percentile
26.0%
Attack Vector
LOCAL
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-269
Status
published
Products (1)
nagios/nagios_core
< 4.3.4
Published
Sep 11, 2017
Tracked Since
Feb 18, 2026