CVE-2016-10089 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-10089): Nagios 4.2.4 and earlier allows local users to gain root privileges via a hard link attack on the Nagios init script file, related to CVE-2016-8641.
@Maintainers could you please confirm if we are affected by this CVE? Specially 3.5.1. Thank you
That's my CVE =P Yes, 3.5.1 is still vulnerable to this (and everything else reported in the past couple of years).
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=8a6c86311831919c79c94f0b4744e05691fe5045 commit 8a6c86311831919c79c94f0b4744e05691fe5045 Author: Michael Orlitzky <mjo@gentoo.org> AuthorDate: 2017-11-02 16:33:39 +0000 Commit: Michael Orlitzky <mjo@gentoo.org> CommitDate: 2017-11-04 23:37:20 +0000 net-analyzer/pnp4nagios: new revision to fix nagios/icinga "or" dependency. Previous revisions of pnp4nagios have an "or" dependency on either Nagios or Icinga, || ( net-analyzer/nagios-core net-analyzer/icinga ... The way "or" dependencies work is that they are considered satisfied if any elements of the associated group are installed. Thus the above stanza allows Nagios and Icinga to be swapped out without rebuilding pnp4nagios. That is incorrect, since later in the ebuild, nagios- or icinga-specific paths are compiled into pnp4nagios. The usual solution to that problem is to choose a default package that satisfies the "one of these" dependency, but to allow the user to specify one with a USE flag. This new revision adds three USE flags: icinga, icinga2, and nagios. The "nagios" flag is enabled by default, and builds pnp4nagios against net-analyzer/nagios. The other flags build against the associated package. In the process, the dependency on nagios-3.x was loosened to accept nagios-4.x as well. The nagios-3.x series has been end-of-life'd, and has multiple open security bugs. Bug: https://bugs.gentoo.org/628086 Bug: https://bugs.gentoo.org/629380 Bug: https://bugs.gentoo.org/636234 Closes: https://bugs.gentoo.org/600424 Package-Manager: Portage-2.3.8, Repoman-2.3.3 net-analyzer/pnp4nagios/metadata.xml | 16 ++++++++++++++ ...s-0.6.26.ebuild => pnp4nagios-0.6.26-r1.ebuild} | 25 ++++++++++++++-------- 2 files changed, 32 insertions(+), 9 deletions(-)}
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=8912285b30dc5dcf76d10a7810444ef69ae8e760 commit 8912285b30dc5dcf76d10a7810444ef69ae8e760 Author: Michael Orlitzky <mjo@gentoo.org> AuthorDate: 2018-06-19 22:32:18 +0000 Commit: Michael Orlitzky <mjo@gentoo.org> CommitDate: 2018-06-19 22:41:53 +0000 net-analyzer/nagios-core: finally drop nagios-3.x from the tree. A bunch of security bugs (and my own personal happiness) were blocked on this because nagios-3.x was sometimes required by an old version of net-analyzer/pnp4nagios. Now that a version of pnp4nagios has been stabilized with more reasonable dependencies, we can finally get rid of nagios-3.x. This leaves a bunch of unused files in FILESDIR that I'll clean up in another commit. Bug: https://bugs.gentoo.org/636234 Bug: https://bugs.gentoo.org/628086 Bug: https://bugs.gentoo.org/629380 Package-Manager: Portage-2.3.40, Repoman-2.3.9 net-analyzer/nagios-core/Manifest | 1 - net-analyzer/nagios-core/nagios-core-3.5.1.ebuild | 216 ---------------------- 2 files changed, 217 deletions(-)
