Security update for icinga SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2022:3576-1 Final 1 1 2022-10-13T09:11:52Z current 2022-10-13T09:11:52Z 2022-10-13T09:11:52Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for icinga This update for icinga fixes the following issues: - CVE-2016-9566: Fixed root privilege escalation (bsc#1014637). - CVE-2019-3698: Fixed symbolic link vulnerability that can cause DoS or potentially escalate privileges (bsc#1156309). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2022-3576,SUSE-SLE-Manager-Tools-12-2022-3576 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2022/suse-su-20223576-1/ Link for SUSE-SU-2022:3576-1 https://lists.suse.com/pipermail/sle-security-updates/2022-October/012534.html E-Mail link for SUSE-SU-2022:3576-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1014637 SUSE Bug 1014637 https://bugzilla.suse.com/1156309 SUSE Bug 1156309 https://www.suse.com/security/cve/CVE-2016-9566/ SUSE CVE CVE-2016-9566 page https://www.suse.com/security/cve/CVE-2019-3698/ SUSE CVE CVE-2019-3698 page SUSE Manager Tools 12 icinga-1.13.3-12.6.1 icinga-devel-1.13.3-12.6.1 icinga-doc-1.13.3-12.6.1 icinga-idoutils-1.13.3-12.6.1 icinga-idoutils-mysql-1.13.3-12.6.1 icinga-idoutils-oracle-1.13.3-12.6.1 icinga-idoutils-pgsql-1.13.3-12.6.1 icinga-plugins-downtimes-1.13.3-12.6.1 icinga-plugins-eventhandlers-1.13.3-12.6.1 icinga-www-1.13.3-12.6.1 icinga-www-config-1.13.3-12.6.1 monitoring-tools-1.13.3-12.6.1 icinga-1.13.3-12.6.1 as a component of SUSE Manager Tools 12 icinga-devel-1.13.3-12.6.1 as a component of SUSE Manager Tools 12 icinga-doc-1.13.3-12.6.1 as a component of SUSE Manager Tools 12 icinga-idoutils-1.13.3-12.6.1 as a component of SUSE Manager Tools 12 icinga-idoutils-mysql-1.13.3-12.6.1 as a component of SUSE Manager Tools 12 icinga-idoutils-oracle-1.13.3-12.6.1 as a component of SUSE Manager Tools 12 icinga-idoutils-pgsql-1.13.3-12.6.1 as a component of SUSE Manager Tools 12 icinga-plugins-downtimes-1.13.3-12.6.1 as a component of SUSE Manager Tools 12 icinga-plugins-eventhandlers-1.13.3-12.6.1 as a component of SUSE Manager Tools 12 icinga-www-1.13.3-12.6.1 as a component of SUSE Manager Tools 12 icinga-www-config-1.13.3-12.6.1 as a component of SUSE Manager Tools 12 monitoring-tools-1.13.3-12.6.1 as a component of SUSE Manager Tools 12 base/logging.c in Nagios Core before 4.2.4 allows local users with access to an account in the nagios group to gain root privileges via a symlink attack on the log file. NOTE: this can be leveraged by remote attackers using CVE-2016-9565. CVE-2016-9566 SUSE Manager Tools 12:icinga-1.13.3-12.6.1 SUSE Manager Tools 12:icinga-devel-1.13.3-12.6.1 SUSE Manager Tools 12:icinga-doc-1.13.3-12.6.1 SUSE Manager Tools 12:icinga-idoutils-1.13.3-12.6.1 SUSE Manager Tools 12:icinga-idoutils-mysql-1.13.3-12.6.1 SUSE Manager Tools 12:icinga-idoutils-oracle-1.13.3-12.6.1 SUSE Manager Tools 12:icinga-idoutils-pgsql-1.13.3-12.6.1 SUSE Manager Tools 12:icinga-plugins-downtimes-1.13.3-12.6.1 SUSE Manager Tools 12:icinga-plugins-eventhandlers-1.13.3-12.6.1 SUSE Manager Tools 12:icinga-www-1.13.3-12.6.1 SUSE Manager Tools 12:icinga-www-config-1.13.3-12.6.1 SUSE Manager Tools 12:monitoring-tools-1.13.3-12.6.1 important 6.6 AV:L/AC:M/Au:S/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20223576-1/ https://www.suse.com/security/cve/CVE-2016-9566.html CVE-2016-9566 https://bugzilla.suse.com/1014637 SUSE Bug 1014637 UNIX Symbolic Link (Symlink) Following vulnerability in the cronjob shipped with nagios of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 11; openSUSE Factory allows local attackers to cause cause DoS or potentially escalate privileges by winning a race. This issue affects: SUSE Linux Enterprise Server 12 nagios version 3.5.1-5.27 and prior versions. SUSE Linux Enterprise Server 11 nagios version 3.0.6-1.25.36.3.1 and prior versions. openSUSE Factory nagios version 4.4.5-2.1 and prior versions. CVE-2019-3698 SUSE Manager Tools 12:icinga-1.13.3-12.6.1 SUSE Manager Tools 12:icinga-devel-1.13.3-12.6.1 SUSE Manager Tools 12:icinga-doc-1.13.3-12.6.1 SUSE Manager Tools 12:icinga-idoutils-1.13.3-12.6.1 SUSE Manager Tools 12:icinga-idoutils-mysql-1.13.3-12.6.1 SUSE Manager Tools 12:icinga-idoutils-oracle-1.13.3-12.6.1 SUSE Manager Tools 12:icinga-idoutils-pgsql-1.13.3-12.6.1 SUSE Manager Tools 12:icinga-plugins-downtimes-1.13.3-12.6.1 SUSE Manager Tools 12:icinga-plugins-eventhandlers-1.13.3-12.6.1 SUSE Manager Tools 12:icinga-www-1.13.3-12.6.1 SUSE Manager Tools 12:icinga-www-config-1.13.3-12.6.1 SUSE Manager Tools 12:monitoring-tools-1.13.3-12.6.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20223576-1/ https://www.suse.com/security/cve/CVE-2019-3698.html CVE-2019-3698 https://bugzilla.suse.com/1150550 SUSE Bug 1150550 https://bugzilla.suse.com/1156309 SUSE Bug 1156309