{"id":"CVE-2016-10089","aliases":["EUVD-2016-1281","GHSA-q77f-5m65-8q6j","SUSE-SU-2018:3240-1","SUSE-SU-2018:3620-1"],"status":"published","title":"Nagios 4.3.2 and earlier allows local users to gain root privileges via a hard link attack on the...","description":"Nagios 4.3.2 and earlier allows local users to gain root privileges via a hard link attack on the Nagios init script file, related to CVE-2016-8641.","severity":{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.00517,"percentile":0.44243,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-264"],"published":"2017-02-15T15:00:00Z","modified":"2026-10-24T10:30:54Z","affected":[{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"nagios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.6-1.25.36.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"nagios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.6-1.25.36.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"nagios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.6-1.25.36.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 12","package":"icinga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.3-12.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"icinga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.3-12.3.1"}]}],"bundled":3}],"products":[{"vendor":"nagios","product":"nagios"}],"references":[{"url":"http://www.securityfocus.com/bid/95171","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2016/12/30/6","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-10089"},{"url":"https://github.com/advisories/GHSA-q77f-5m65-8q6j"},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20183240-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1011630","tags":["report"]},{"url":"https://bugzilla.suse.com/1018047","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10089","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8641","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20183620-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/952777","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8010","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2016-10089","description":"Nagios 4.3.2 and earlier allows local users to gain root privileges via a hard link attack on the Nagios init script file, related to CVE-2016-8641.","status":"published","published":"2017-02-15T15:00:00Z","modified":"2024-08-06T03:07:32.24Z","updated_at":"2026-11-02T14:33:31.117878Z"}],"euvd":[{"id":"EUVD-2016-1281","description":"Nagios 4.3.2 and earlier allows local users to gain root privileges via a hard link attack on the Nagios init script file, related to CVE-2016-8641.","status":"published","published":"2017-02-15T15:00:00Z","modified":"2024-08-06T03:07:32Z","updated_at":"2026-11-03T02:22:25.285099Z"}],"ghsa":[{"id":"GHSA-q77f-5m65-8q6j","title":"Nagios 4.3.2 and earlier allows local users to gain root privileges via a hard link attack on the...","description":"Nagios 4.3.2 and earlier allows local users to gain root privileges via a hard link attack on the Nagios init script file, related to CVE-2016-8641.","status":"published","published":"2022-05-17T00:21:59Z","modified":"2023-02-03T05:01:36Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T14:53:00.497966Z"}],"nvd":[{"id":"CVE-2016-10089","description":"Nagios 4.3.2 and earlier allows local users to gain root privileges via a hard link attack on the Nagios init script file, related to CVE-2016-8641.","status":"published","published":"2017-02-15T15:59:00.277Z","modified":"2026-06-17T00:39:02.253Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":7.2,"vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-264"],"updated_at":"2026-11-02T14:03:35.822579Z"}],"osv":[{"id":"CVE-2016-10089","description":"Nagios 4.3.2 and earlier allows local users to gain root privileges via a hard link attack on the Nagios init script file, related to CVE-2016-8641.","status":"published","published":"2017-02-15T15:59:00.277Z","modified":"2026-10-24T10:30:54.168030701Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:01.531338Z"},{"id":"SUSE-SU-2018:3240-1","title":"Security update for nagios","description":"This update for nagios fixes the following issues:\n\n- CVE-2016-8641 / CVE-2016-10089: fixed possible symlink attacks for files/directories created by root (bsc#1011630 / bsc#1018047)\n","status":"published","published":"2018-10-19T09:23:30Z","modified":"2026-02-04T02:38:38.584137Z","updated_at":"2026-11-02T15:53:45.378228Z"},{"id":"SUSE-SU-2018:3620-1","title":"Security update for icinga","description":"This update for icinga fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2015-8010: Fixed XSS in the icinga classic UI (boo#952777)\n- CVE-2016-8641 / CVE-2016-10089: fixed a possible symlink attack for files/dirs created by root (boo#1011630 and boo#1018047)\n\n","status":"published","published":"2018-11-05T16:57:03Z","modified":"2026-02-04T03:50:12.730269Z","updated_at":"2026-11-02T15:53:45.378228Z"}]}}