Nagios Core 4.2.4 closes serious root privilege escalation bug

If you’re using Nagios Core to monitor your systems, networks and infrastructure, and you have not updated to version 4.2.4, you better hop to it.

This latest release fixes a high severity root privilege escalation vulnerability (CVE-2016-9566) discovered by researcher Dawid Golunski, who published a proof-of-concept exploit for it on Thursday.

“Nagios Core daemon in versions below 4.2.4 was found to perform unsafe operations when handling the log file. This could be exploited by malicious local attackers to escalate their privileges from ‘nagios’ system user, or from a user belonging to ‘nagios’ group, to root. The exploit could enable the attackers to fully compromise the system on which a vulnerable Nagios version was installed,” Golunski explained in the advisory.

He also pointed out that an attacker could obtain the necessary level of access by using this exploit in conjunction with that for a remote code execution vulnerability (CVE-2016-9565) discovered by him and patched in version 4.2.2 of the open source software.

Since exploit code for both is now published, and no mitigations were offered, users are advised to implement the update as soon as possible.