Security update for nagios SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2018:3240-1 Final 1 1 2018-10-19T09:23:30Z current 2018-10-19T09:23:30Z 2018-10-19T09:23:30Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for nagios This update for nagios fixes the following issues: - CVE-2016-8641 / CVE-2016-10089: fixed possible symlink attacks for files/directories created by root (bsc#1011630 / bsc#1018047) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). sdksp4-nagios-13820,slessp4-nagios-13820 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2018/suse-su-20183240-1/ Link for SUSE-SU-2018:3240-1 https://lists.suse.com/pipermail/sle-security-updates/2018-October/004743.html E-Mail link for SUSE-SU-2018:3240-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1011630 SUSE Bug 1011630 https://bugzilla.suse.com/1018047 SUSE Bug 1018047 https://www.suse.com/security/cve/CVE-2016-10089/ SUSE CVE CVE-2016-10089 page https://www.suse.com/security/cve/CVE-2016-8641/ SUSE CVE CVE-2016-8641 page SUSE Linux Enterprise Server 11 SP4 SUSE Linux Enterprise Server for SAP Applications 11 SP4 SUSE Linux Enterprise Software Development Kit 11 SP4 nagios-3.0.6-1.25.36.3.1 nagios-devel-3.0.6-1.25.36.3.1 nagios-www-3.0.6-1.25.36.3.1 nagios-3.0.6-1.25.36.3.1 as a component of SUSE Linux Enterprise Server 11 SP4 nagios-www-3.0.6-1.25.36.3.1 as a component of SUSE Linux Enterprise Server 11 SP4 nagios-3.0.6-1.25.36.3.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 nagios-www-3.0.6-1.25.36.3.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 nagios-3.0.6-1.25.36.3.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 nagios-devel-3.0.6-1.25.36.3.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 nagios-www-3.0.6-1.25.36.3.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 Nagios 4.3.2 and earlier allows local users to gain root privileges via a hard link attack on the Nagios init script file, related to CVE-2016-8641. CVE-2016-10089 SUSE Linux Enterprise Server 11 SP4:nagios-3.0.6-1.25.36.3.1 SUSE Linux Enterprise Server 11 SP4:nagios-www-3.0.6-1.25.36.3.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:nagios-3.0.6-1.25.36.3.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:nagios-www-3.0.6-1.25.36.3.1 SUSE Linux Enterprise Software Development Kit 11 SP4:nagios-3.0.6-1.25.36.3.1 SUSE Linux Enterprise Software Development Kit 11 SP4:nagios-devel-3.0.6-1.25.36.3.1 SUSE Linux Enterprise Software Development Kit 11 SP4:nagios-www-3.0.6-1.25.36.3.1 moderate 6.9 AV:L/AC:M/Au:N/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20183240-1/ https://www.suse.com/security/cve/CVE-2016-10089.html CVE-2016-10089 https://bugzilla.suse.com/1011630 SUSE Bug 1011630 https://bugzilla.suse.com/1018047 SUSE Bug 1018047 A privilege escalation vulnerability was found in nagios 4.2.x that occurs in daemon-init.in when creating necessary files and insecurely changing the ownership afterwards. It's possible for the local attacker to create symbolic links before the files are to be created and possibly escalating the privileges with the ownership change. CVE-2016-8641 SUSE Linux Enterprise Server 11 SP4:nagios-3.0.6-1.25.36.3.1 SUSE Linux Enterprise Server 11 SP4:nagios-www-3.0.6-1.25.36.3.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:nagios-3.0.6-1.25.36.3.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:nagios-www-3.0.6-1.25.36.3.1 SUSE Linux Enterprise Software Development Kit 11 SP4:nagios-3.0.6-1.25.36.3.1 SUSE Linux Enterprise Software Development Kit 11 SP4:nagios-devel-3.0.6-1.25.36.3.1 SUSE Linux Enterprise Software Development Kit 11 SP4:nagios-www-3.0.6-1.25.36.3.1 moderate 4.4 AV:L/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20183240-1/ https://www.suse.com/security/cve/CVE-2016-8641.html CVE-2016-8641 https://bugzilla.suse.com/1011630 SUSE Bug 1011630 https://bugzilla.suse.com/1018047 SUSE Bug 1018047