Nagios 4.2.4 and earlier allows local users to gain root privileges via a hard link attack on the Nagios init script file, related to CVE-2016-8641. External References: http://www.openwall.com/lists/oss-security/2016/12/30/5
Created nagios tracking bugs for this issue: Affects: epel-all [bug 1510929] Affects: fedora-all [bug 1510928]
Statement: Red Hat Product Security has rated this issue as having Low security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.
Mitigation: This flaw, and others like it, are mitigated by enabling hardlink and symlink protections. These protections are enabled by default in Red Hat Enterprise Linux 7 and this vulnerability will only be exploitable if disabled. Ensure the following protections are enabled: sysctl -w fs.protected_hardlinks=1 sysctl -w fs.protected_symlinks=1