[ GLSA 201812-03 ] Nagios

[GLSA]

Gentoo Linux Security Advisory

Title: Nagios: Privilege escalation (GLSA 201812-03)
Severity: normal
Exploitable: local
Date: 2018-12-02
Bug(s): #629380
ID: 201812-03

Synopsis

A vulnerability in Nagios allows local users to escalate
privileges.


Background

Nagios is an open source host, service and network monitoring program.

Affected Packages

Package: net-analyzer/nagios-core
Vulnerable: < 4.3.4
Unaffected: >= 4.3.4
Architectures: All supported architectures


Description

A vulnerability in Nagios was discovered due to the improper handling of
configuration files which can be owned by a non-root user.


Impact

A local attacker can escalate privileges to root by leveraging access to
a non-root owned configuration file.


Workaround

There is no known workaround at this time.

Resolution

All Nagios users should upgrade to the latest version: