Skip to content

CVE-2016-9566

base/logging.c in Nagios Core before 4.2.4 allows local users with access to an account in the...

7.8 HighPublic exploitFix available

base/logging.c in Nagios Core before 4.2.4 allows local users with access to an account in the nagios group to gain root privileges via a symlink attack on the log file. NOTE: this can be leveraged by remote attackers using CVE-2016-9565.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

4.88%Up 0.2 points since Feb 4, 2022

What each source reports

NVD Score used 7.8

base/logging.c in Nagios Core before 4.2.4 allows local users with access to an account in the nagios group to gain root privileges via a symlink attack on the log file. NOTE: this can be leveraged by remote attackers using CVE-2016-9565.

Record: CVE-2016-9566
CVSS 3.0: 7.8 HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 7.2 HighAV:L/AC:L/Au:N/C:C/I:C/A:C
Weakness: CWE-59, CWE-264
Updated: 2026-11-02

CVE List No score

base/logging.c in Nagios Core before 4.2.4 allows local users with access to an account in the nagios group to gain root privileges via a symlink attack on the log file. NOTE: this can be leveraged by remote attackers using CVE-2016-9565.

Record: CVE-2016-9566
Updated: 2026-11-02

EUVDEUVD-2016-10372 No score

base/logging.c in Nagios Core before 4.2.4 allows local users with access to an account in the nagios group to gain root privileges via a symlink attack on the log file. NOTE: this can be leveraged by remote attackers using CVE-2016-9565.

Record: EUVD-2016-10372
Updated: 2026-11-03

GitHub AdvisoriesGHSA-9332-j4wp-2xcq 7.8

base/logging.c in Nagios Core before 4.2.4 allows local users with access to an account in the...

base/logging.c in Nagios Core before 4.2.4 allows local users with access to an account in the nagios group to gain root privileges via a symlink attack on the log file. NOTE: this can be leveraged by remote attackers using CVE-2016-9565.

Record: GHSA-9332-j4wp-2xcq
CVSS 3.0: 7.8 HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-59
Updated: 2026-11-02

OSV 7.8

base/logging.c in Nagios Core before 4.2.4 allows local users with access to an account in the nagios group to gain root privileges via a symlink attack on the log file. NOTE: this can be leveraged by remote attackers using CVE-2016-9565.

Record: CVE-2016-9566
CVSS 3.0: 7.8 HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2017:0211 8.1

Red Hat Security Advisory: nagios security update

Record: RHSA-2017:0211
CVSS 3.0: 8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 11 moreShow less

OSVRHSA-2017:0212 8.1

Red Hat Security Advisory: nagios security update

Record: RHSA-2017:0212
CVSS 3.0: 8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2017:0213 8.1

Red Hat Security Advisory: nagios security update

Record: RHSA-2017:0213
CVSS 3.0: 8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2017:0214 8.1

Red Hat Security Advisory: nagios security update

Record: RHSA-2017:0214
CVSS 3.0: 8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2017:0258 8.1

Red Hat Security Advisory: nagios security update

Record: RHSA-2017:0258
CVSS 3.0: 8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2017:0259 8.1

Red Hat Security Advisory: nagios security update

Record: RHSA-2017:0259
CVSS 3.0: 8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2016-9566 7.8

base/logging.c in Nagios Core before 4.2.4 allows local users with access to an account in the nagios group to gain root privileges via a symlink attack on the log file. NOTE: this can be leveraged by remote attackers using CVE-2016-9565.

Record: UBUNTU-CVE-2016-9566
CVSS 3.0: 7.8 HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVMGASA-2017-0045 No score

Updated nagios packages fix security vulnerabilities

The nagios package has been patched to fix the following issues:

Improper sanitization of RSS feed input enables unauthenticated remote read and write of arbitrary files (CVE-2016-9565).

Unsafe logfile handling allows unprivileged users to escalate their privileges to root (CVE-2016-9566).

Record: MGASA-2017-0045
Updated: 2026-11-02

OSVopenSUSE-SU-2024:11073-1 No score

nagios-4.4.6-2.5 on GA media

These are all security issues fixed in the nagios-4.4.6-2.5 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:11073-1
Updated: 2026-11-02

OSVSUSE-SU-2022:3576-1 No score

Security update for icinga

This update for icinga fixes the following issues:

CVE-2016-9566: Fixed root privilege escalation (bsc#1014637).
CVE-2019-3698: Fixed symbolic link vulnerability that can cause DoS or potentially escalate privileges (bsc#1156309).

Record: SUSE-SU-2022:3576-1
Updated: 2026-11-02

OSVSUSE-SU-2024:1629-1 No score

Security update for SUSE Manager Client Tools Beta

This update for SUSE Manager Client Tools Beta fixes the following issues:

Changed codestream origin of SUSE Manager Client Tools Beta (no source changes)

icinga in SUSE Manager Client Tools Beta also received the following security fixes:

CVE-2016-9566: Fixed root privilege escalation (bsc#1014637)
CVE-2019-3698 : Symbolic Link (Symlink) following vulnerability in the cronjob allows local attackers to cause cause DoS or potentially escalate privileges by winning a race (bsc#1156309)

Record: SUSE-SU-2024:1629-1
Updated: 2026-11-02

OSVUSN-3253-1 No score

nagios3 vulnerabilities

It was discovered that Nagios incorrectly handled certain long strings. A remote authenticated attacker could use this issue to cause Nagios to crash, resulting in a denial of service, or possibly obtain sensitive information. (CVE-2013-7108, CVE-2013-7205)

It was discovered that Nagios incorrectly handled certain long messages to cmd.cgi. A remote attacker could possibly use this issue to cause Nagios to crash, resulting in a denial of service. (CVE-2014-1878)

Dawid Golunski discovered that Nagios incorrectly handled symlinks when accessing log files. A local attacker could possibly use this issue to elevate privileges. In the default installation of Ubuntu, this should be prevented by the Yama link restrictions. (CVE-2016-9566)

Record: USN-3253-1
Updated: 2026-11-02

Affected products

nagios

Affected packages

Affected packages
Package	Affected	Fixed
`nagios3` Debian:8 From an advisory covering 5 CVEs	before 3.5.1.dfsg-2+deb8u1, plus listed versions 3.5.1.dfsg-2	3.5.1.dfsg-2+deb8u1
`nagios3` Debian:7 From an advisory covering 2 CVEs	before 3.4.1-3+deb7u3, plus listed versions 3.4.1-33.4.1-3+deb7u13.4.1-3+deb7u2	3.4.1-3+deb7u3
`nagios` Mageia:5 From an advisory covering 2 CVEs	before 4.0.8-3.1.mga5	4.0.8-3.1.mga5
`nagios` Red Hat:openstack:5::el7 From an advisory covering 5 CVEs	before 0:3.5.1-9.el7	0:3.5.1-9.el7
`nagios-common` Red Hat:openstack:5::el7 From an advisory covering 5 CVEs	before 0:3.5.1-9.el7	0:3.5.1-9.el7
`nagios-debuginfo` Red Hat:openstack:5::el7 From an advisory covering 5 CVEs	before 0:3.5.1-9.el7	0:3.5.1-9.el7
`nagios-devel` Red Hat:openstack:5::el7 From an advisory covering 5 CVEs	before 0:3.5.1-9.el7	0:3.5.1-9.el7
`nagios` Red Hat:openstack:5::el6 From an advisory covering 5 CVEs	before 0:3.5.1-9.el6	0:3.5.1-9.el6
`nagios-common` Red Hat:openstack:5::el6 From an advisory covering 5 CVEs	before 0:3.5.1-9.el6	0:3.5.1-9.el6
`nagios-debuginfo` Red Hat:openstack:5::el6 From an advisory covering 5 CVEs	before 0:3.5.1-9.el6	0:3.5.1-9.el6

Show 45 moreShow less

Affected packages
Package	Affected	Fixed
`nagios-devel` Red Hat:openstack:5::el6 From an advisory covering 5 CVEs	before 0:3.5.1-9.el6	0:3.5.1-9.el6
`nagios` Red Hat:openstack:6::el7 From an advisory covering 5 CVEs	before 0:3.5.1-9.el7	0:3.5.1-9.el7
`nagios-common` Red Hat:openstack:6::el7 From an advisory covering 5 CVEs	before 0:3.5.1-9.el7	0:3.5.1-9.el7
`nagios-debuginfo` Red Hat:openstack:6::el7 From an advisory covering 5 CVEs	before 0:3.5.1-9.el7	0:3.5.1-9.el7
`nagios` Red Hat:openstack:7::el7 From an advisory covering 5 CVEs	before 0:3.5.1-9.el7	0:3.5.1-9.el7
`nagios-common` Red Hat:openstack:7::el7 From an advisory covering 5 CVEs	before 0:3.5.1-9.el7	0:3.5.1-9.el7
`nagios-debuginfo` Red Hat:openstack:7::el7 From an advisory covering 5 CVEs	before 0:3.5.1-9.el7	0:3.5.1-9.el7
`nagios` Red Hat:storage:3.1:nagios:el7 From an advisory covering 2 CVEs	before 0:3.5.1-9.el7	0:3.5.1-9.el7
`nagios-common` Red Hat:storage:3.1:nagios:el7 From an advisory covering 2 CVEs	before 0:3.5.1-9.el7	0:3.5.1-9.el7
`nagios-debuginfo` Red Hat:storage:3.1:nagios:el7 From an advisory covering 2 CVEs	before 0:3.5.1-9.el7	0:3.5.1-9.el7
`nagios` Red Hat:storage:3.1:server:el7 From an advisory covering 2 CVEs	before 0:3.5.1-9.el7	0:3.5.1-9.el7
`nagios-common` Red Hat:storage:3.1:server:el7 From an advisory covering 2 CVEs	before 0:3.5.1-9.el7	0:3.5.1-9.el7
`nagios-debuginfo` Red Hat:storage:3.1:server:el7 From an advisory covering 2 CVEs	before 0:3.5.1-9.el7	0:3.5.1-9.el7
`nagios` Red Hat:storage:3.1:nagios:el6 From an advisory covering 2 CVEs	before 0:3.5.1-9.el6	0:3.5.1-9.el6
`nagios-common` Red Hat:storage:3.1:nagios:el6 From an advisory covering 2 CVEs	before 0:3.5.1-9.el6	0:3.5.1-9.el6
`nagios-debuginfo` Red Hat:storage:3.1:nagios:el6 From an advisory covering 2 CVEs	before 0:3.5.1-9.el6	0:3.5.1-9.el6
`nagios-devel` Red Hat:storage:3.1:nagios:el6 From an advisory covering 2 CVEs	before 0:3.5.1-9.el6	0:3.5.1-9.el6
`nagios` Red Hat:storage:3.1:server:el6 From an advisory covering 2 CVEs	before 0:3.5.1-9.el6	0:3.5.1-9.el6
`nagios-common` Red Hat:storage:3.1:server:el6 From an advisory covering 2 CVEs	before 0:3.5.1-9.el6	0:3.5.1-9.el6
`nagios-debuginfo` Red Hat:storage:3.1:server:el6 From an advisory covering 2 CVEs	before 0:3.5.1-9.el6	0:3.5.1-9.el6
`icinga` SUSE:Manager Client Tools 12 From an advisory covering 2 CVEs	before 1.13.3-12.6.1	1.13.3-12.6.1
`grafana-ha-cluster-dashboards` SUSE:Manager Client Tools 12 From an advisory covering 2 CVEs	before 1.1.0+git.1605027022.a84d536-1.10.1	1.1.0+git.1605027022.a84d536-1.10.1
`grafana-sap-netweaver-dashboards` SUSE:Manager Client Tools 12 From an advisory covering 2 CVEs	before 1.0.3+git.1601889366.9f71957-1.10.1	1.0.3+git.1601889366.9f71957-1.10.1
`grafana-sap-providers` SUSE:Manager Client Tools 12 From an advisory covering 2 CVEs	before 1.1-1.7.1	1.1-1.7.1
`hwdata` SUSE:Manager Client Tools 12 From an advisory covering 2 CVEs	before 0.314-10.14.1	0.314-10.14.1
`icinga` SUSE:Manager Client Tools 12 From an advisory covering 2 CVEs	before 1.13.3-12.8.1	1.13.3-12.8.1
`sysuser-tools` SUSE:Manager Client Tools 12 From an advisory covering 2 CVEs	before 2.0-1.9.1	2.0-1.9.1
`zeromq` SUSE:Manager Client Tools 12 From an advisory covering 2 CVEs	before 4.0.4-15.8.1	4.0.4-15.8.1
`grafana-ha-cluster-dashboards` SUSE:Manager Client Tools 12-BETA From an advisory covering 2 CVEs	before 1.1.0+git.1605027022.a84d536-1.10.1	1.1.0+git.1605027022.a84d536-1.10.1
`grafana-sap-netweaver-dashboards` SUSE:Manager Client Tools 12-BETA From an advisory covering 2 CVEs	before 1.0.3+git.1601889366.9f71957-1.10.1	1.0.3+git.1601889366.9f71957-1.10.1
`grafana-sap-providers` SUSE:Manager Client Tools 12-BETA From an advisory covering 2 CVEs	before 1.1-1.7.1	1.1-1.7.1
`icinga` SUSE:Manager Client Tools 12-BETA From an advisory covering 2 CVEs	before 1.13.3-12.8.1	1.13.3-12.8.1
`sysuser-tools` SUSE:Manager Client Tools 12-BETA From an advisory covering 2 CVEs	before 2.0-1.9.1	2.0-1.9.1
`zeromq` SUSE:Manager Client Tools 12-BETA From an advisory covering 2 CVEs	before 4.0.4-15.8.1	4.0.4-15.8.1
`zeromq` SUSE:Linux Enterprise Module for Advanced Systems Management 12 From an advisory covering 2 CVEs	before 4.0.4-15.8.1	4.0.4-15.8.1
`sysuser-tools` SUSE:Linux Enterprise Module for Containers 12 From an advisory covering 2 CVEs	before 2.0-1.9.1	2.0-1.9.1
`zeromq` SUSE:Linux Enterprise Software Development Kit 12 SP5 From an advisory covering 2 CVEs	before 4.0.4-15.8.1	4.0.4-15.8.1
`sysuser-tools` SUSE:Linux Enterprise Server 12 SP5 From an advisory covering 2 CVEs	before 2.0-1.9.1	2.0-1.9.1
`sysuser-tools` SUSE:Linux Enterprise Server for SAP Applications 12 SP5 From an advisory covering 2 CVEs	before 2.0-1.9.1	2.0-1.9.1
`zeromq` SUSE:Linux Enterprise Workstation Extension 12 SP5 From an advisory covering 2 CVEs	before 4.0.4-15.8.1	4.0.4-15.8.1
`nagios3` Ubuntu:14.04:LTS	before 3.5.1-1ubuntu1.1, plus listed versions 3.4.1-5ubuntu23.4.1-5ubuntu33.5.1-1ubuntu1	3.5.1-1ubuntu1.1
`nagios3` Ubuntu:16.04:LTS	before 3.5.1.dfsg-2.1ubuntu1.1, plus listed versions 3.5.1-1ubuntu43.5.1.dfsg-2ubuntu13.5.1.dfsg-2ubuntu23.5.1.dfsg-2.1ubuntu1	3.5.1.dfsg-2.1ubuntu1.1
`nagios3` Ubuntu:14.04:LTS From an advisory covering 4 CVEs	before 3.5.1-1ubuntu1.1, plus listed versions 3.4.1-5ubuntu23.4.1-5ubuntu33.5.1-1ubuntu1	3.5.1-1ubuntu1.1
`nagios3` Ubuntu:16.04:LTS From an advisory covering 4 CVEs	before 3.5.1.dfsg-2.1ubuntu1.1, plus listed versions 3.5.1-1ubuntu43.5.1.dfsg-2ubuntu13.5.1.dfsg-2ubuntu23.5.1.dfsg-2.1ubuntu1	3.5.1.dfsg-2.1ubuntu1.1
`nagios` openSUSE:Tumbleweed From an advisory covering 17 CVEs	before 4.4.6-2.5	4.4.6-2.5

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	Nagios < 4.2.4 - Local Privilege Escalation	2016-12-15

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2016-9566 is a high vulnerability (CVSS 7.8) in Nagios, published December 15, 2016. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 4.88%, the 92nd percentile. Fixed in nagios3 3.5.1-1ubuntu1.1.

References

Show 75 moreShow less