{"id":"CVE-2016-8641","aliases":["EUVD-2016-9482","GHSA-xh33-x4fq-3r2h","SUSE-SU-2018:3240-1","SUSE-SU-2018:3620-1","openSUSE-SU-2024:11073-1"],"status":"published","title":"A privilege escalation vulnerability was found in nagios 4.2.x that occurs in daemon-init.in when...","description":"A privilege escalation vulnerability was found in nagios 4.2.x that occurs in daemon-init.in when creating necessary files and insecurely changing the ownership afterwards. It's possible for the local attacker to create symbolic links before the files are to be created and possibly escalating the privileges with the ownership change.","severity":{"version":"3.0","score":6.7,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-07","score":0.01141,"percentile":0.66838,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-59"],"published":"2018-08-01T14:00:00Z","modified":"2026-10-20T10:47:31Z","exploits":[{"source":"exploitdb","id":"EDB-40774","title":"Nagios 4.2.2 - Local Privilege Escalation","type":"local","platform":"linux","date":"2016-11-18","verified":true,"url":"https://www.exploit-db.com/exploits/40774"}],"affected":[{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"nagios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.6-1.25.36.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"nagios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.6-1.25.36.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"nagios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.6-1.25.36.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 12","package":"icinga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.3-12.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"icinga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.3-12.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nagios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.6-2.5"}]}],"bundled":17}],"products":[{"vendor":"nagios","product":"nagios"},{"vendor":"nagios enterprises","product":"nagios"}],"references":[{"url":"https://www.exploit-db.com/exploits/40774/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence"]},{"url":"https://github.com/NagiosEnterprises/nagioscore/commit/f2ed227673d3b2da643eb5cad26b2d87674f28c1.patch","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8641","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"http://www.securityfocus.com/bid/95121","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://security.gentoo.org/glsa/201702-26","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-8641"},{"url":"https://github.com/advisories/GHSA-xh33-x4fq-3r2h"},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20183240-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1011630","tags":["report"]},{"url":"https://bugzilla.suse.com/1018047","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10089","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8641","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20183620-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/952777","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8010","tags":["web"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2006-2162","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-5803","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-4796","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-1523","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2214","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4214","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-7108","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-1878","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0726","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6209","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9566","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12847","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-13441","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18245","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-3698","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13977","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2016-8641","description":"A privilege escalation vulnerability was found in nagios 4.2.x that occurs in daemon-init.in when creating necessary files and insecurely changing the ownership afterwards. It's possible for the local attacker to create symbolic links before the files are to be created and possibly escalating the privileges with the ownership change.","status":"published","published":"2018-08-01T14:00:00Z","modified":"2024-08-06T02:27:41.284Z","cvss":[{"version":"3.0","score":6.7,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T14:33:32.415289Z"}],"euvd":[{"id":"EUVD-2016-9482","description":"A privilege escalation vulnerability was found in nagios 4.2.x that occurs in daemon-init.in when creating necessary files and insecurely changing the ownership afterwards. It's possible for the local attacker to create symbolic links before the files are to be created and possibly escalating the privileges with the ownership change.","status":"published","published":"2018-08-01T14:00:00Z","modified":"2024-08-06T02:27:41Z","cvss":[{"version":"3.0","score":6.7,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-03T02:22:29.639634Z"}],"ghsa":[{"id":"GHSA-xh33-x4fq-3r2h","title":"A privilege escalation vulnerability was found in nagios 4.2.x that occurs in daemon-init.in when...","description":"A privilege escalation vulnerability was found in nagios 4.2.x that occurs in daemon-init.in when creating necessary files and insecurely changing the ownership afterwards. It's possible for the local attacker to create symbolic links before the files are to be created and possibly escalating the privileges with the ownership change.","status":"published","published":"2022-05-13T01:38:38Z","modified":"2023-02-01T05:08:54Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T14:50:53.268012Z"}],"nvd":[{"id":"CVE-2016-8641","description":"A privilege escalation vulnerability was found in nagios 4.2.x that occurs in daemon-init.in when creating necessary files and insecurely changing the ownership afterwards. It's possible for the local attacker to create symbolic links before the files are to be created and possibly escalating the privileges with the ownership change.","status":"published","published":"2018-08-01T14:29:00.253Z","modified":"2026-06-17T00:54:41.07Z","cvss":[{"version":"3.0","score":6.7,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium","assessor":"secondary"},{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":7.2,"vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T14:03:39.621168Z"}],"osv":[{"id":"CVE-2016-8641","description":"A privilege escalation vulnerability was found in nagios 4.2.x that occurs in daemon-init.in when creating necessary files and insecurely changing the ownership afterwards. It's possible for the local attacker to create symbolic links before the files are to be created and possibly escalating the privileges with the ownership change.","status":"published","published":"2018-08-01T14:29:00.253Z","modified":"2026-10-20T10:47:31.052404051Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:03.171316Z"},{"id":"openSUSE-SU-2024:11073-1","title":"nagios-4.4.6-2.5 on GA media","description":"These are all security issues fixed in the nagios-4.4.6-2.5 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:08:19.000922Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"SUSE-SU-2018:3240-1","title":"Security update for nagios","description":"This update for nagios fixes the following issues:\n\n- CVE-2016-8641 / CVE-2016-10089: fixed possible symlink attacks for files/directories created by root (bsc#1011630 / bsc#1018047)\n","status":"published","published":"2018-10-19T09:23:30Z","modified":"2026-02-04T02:38:38.584137Z","updated_at":"2026-11-02T15:53:45.378228Z"},{"id":"SUSE-SU-2018:3620-1","title":"Security update for icinga","description":"This update for icinga fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2015-8010: Fixed XSS in the icinga classic UI (boo#952777)\n- CVE-2016-8641 / CVE-2016-10089: fixed a possible symlink attack for files/dirs created by root (boo#1011630 and boo#1018047)\n\n","status":"published","published":"2018-11-05T16:57:03Z","modified":"2026-02-04T03:50:12.730269Z","updated_at":"2026-11-02T15:53:45.378228Z"}]}}