Bug 1510927 (CVE-2016-10089)

Summary:	CVE-2016-10089 nagios: Privilege escalation due to incomplete fix for CVE-2016-8641
Product:	[Other] Security Response	Reporter:	Adam Mariš <amaris>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	affix, apevec, athmanem, b.heden, chrisw, drusso, jjoyce, jmadigan, jose.p.oliveira.oss, jpadman, jschluet, jshepherd, kbasil, kpiwko, lemenkov, lgriffin, lhh, linux, lpeer, markmc, mburns, mmagr, ngough, pbraun, pwright, rbryant, rcyriac, rrajasek, sclewis, shawn.starr, sisharma, slinaber, smooge, smooge, srevivo, ssaha, s, swilkerson, tdecacqu, vbellur
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A vulnerability was found in Nagios 4.2.4, and earlier, which allows local users to gain root privileges via a hard link attack on the Nagios init script file, related to CVE-2016-8641.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-06-08 03:30:47 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1510928, 1510929
Bug Blocks:	1510935

Description Adam Mariš 2017-11-08 13:05:57 UTC

Nagios 4.2.4 and earlier allows local users to gain root privileges via a hard link attack on the Nagios init script file, related to CVE-2016-8641.

External References:

http://www.openwall.com/lists/oss-security/2016/12/30/5

Comment 1 Adam Mariš 2017-11-08 13:06:40 UTC

Created nagios tracking bugs for this issue:

Affects: epel-all [bug 1510929]
Affects: fedora-all [bug 1510928]

Comment 5 Joshua Padman 2017-11-09 23:35:18 UTC

Statement:

Red Hat Product Security has rated this issue as having Low security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Comment 9 Joshua Padman 2017-11-12 21:43:23 UTC

Mitigation:

This flaw, and others like it, are mitigated by enabling hardlink and symlink protections. These protections are enabled by default in Red Hat Enterprise Linux 7 and this vulnerability will only be exploitable if disabled.
Ensure the following protections are enabled:
  sysctl -w fs.protected_hardlinks=1
  sysctl -w fs.protected_symlinks=1