MagpieRSS, as used in the front-end component in Nagios Core before 4.2.2 might allow remote attackers to read or write to arbitrary files by spoofing a crafted response from the Nagios RSS feed server. NOTE: this vulnerability exists because of an incomplete fix for CVE-2008-4796.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:0214 advisory.

    Nagios is a program that monitors hosts and services on your network, and has the ability to send email or     page alerts when a problem arises or is resolved. Nagios is written in C and designed to run under Linux     (and some other *NIX variants) as a background process, intermittently running checks on various services     that you specify. The actual service checks are performed by separate plugin programs which return the     status of the checks to Nagios. Nagios plugins are available at     http://sourceforge.net/projects/nagiosplug. This package provides the core program, web interface, and     documentation files for Nagios. Development files are built as a separate package.

    Security Fix(es):

    * Various command-execution flaws were found in the Snoopy library included with Nagios. These flaws     allowed remote attackers to execute arbitrary commands by manipulating Nagios HTTP headers.
    (CVE-2008-7313, CVE-2014-5008, CVE-2014-5009)

    * It was found that an attacker who could control the content of an RSS feed could execute code remotely     using the Nagios web interface. This flaw could be used to gain access to the remote system and in some     scenarios control over the system. (CVE-2016-9565)

    * A privileges flaw was found in Nagios where log files were unsafely handled. An attacker who could     control Nagios logging configuration ('nagios' user/group) could exploit the flaw to elevate their access     to that of a privileged user. (CVE-2016-9566)

    Red Hat would like to thank Dawid Golunski for reporting CVE-2016-9565 and CVE-2016-9566.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Update to close CVE

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201710-20 (Nagios: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Nagios. Please review       the referenced CVE identifiers for details.
  Impact :

    A remote attacker could possibly escalate privileges to root, thus       allowing the execution of arbitrary code, by leveraging CVE-2016-9565.
      Additionally, a local attacker could cause a Denial of Service condition       against arbitrary processes due to the improper dropping of privileges.
  Workaround :

    There is no known workaround at this time.

The remote host is affected by the vulnerability described in GLSA-201702-26 (Nagios: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Nagios. Please review       the CVE identifiers referenced below for details.
  Impact :

    A local attacker, who either is already Nagios&rsquo;s system user or       belongs to Nagios&rsquo;s group, could potentially escalate privileges.
    In addition, a remote attacker could read or write to arbitrary files by       spoofing a crafted response from the Nagios RSS feed server.
  Workaround :

    There is no known workaround at this time.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:0259 advisory.

    Nagios is a program that monitors hosts and services on your network, and has the ability to send email or     page alerts when a problem arises or is resolved.

    Security Fix(es):

    * It was found that an attacker who could control the content of an RSS feed could execute code remotely     using the Nagios web interface. This flaw could be used to gain access to the remote system and in some     scenarios control over the system. (CVE-2016-9565)

    * A privilege escalation flaw was found in the way Nagios handled log files. An attacker able to control     the Nagios logging configuration (the 'nagios' user/group) could use this flaw to elevate their privileges     to root. (CVE-2016-9566)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update for nagios is now available for Red Hat Gluster Storage 3.1 for RHEL 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Nagios is a program that monitors hosts and services on your network, and has the ability to send email or page alerts when a problem arises or is resolved.

Security Fix(es) :

* It was found that an attacker who could control the content of an RSS feed could execute code remotely using the Nagios web interface.
This flaw could be used to gain access to the remote system and in some scenarios control over the system. (CVE-2016-9565)

* A privilege escalation flaw was found in the way Nagios handled log files. An attacker able to control the Nagios logging configuration (the 'nagios' user/group) could use this flaw to elevate their privileges to root. (CVE-2016-9566)

Nagios was found to be vulnerable to two security issues that, when combined, lead to a remote root code execution vulnerability.
Fortunately, the hardened permissions of the Debian package limit the effect of those to information disclosure, but privilege escalation to root is still possible locally.

CVE-2016-9565

Improper sanitization of RSS feed input enables unauthenticated remote read and write of arbitrary files which may lead to remote code execution if the web root is writable.

CVE-2016-9566

Unsafe logfile handling allows unprivileged users to escalate their privileges to root. In wheezy, this is possible only through the debug logfile which is disabled by default.

For Debian 7 'Wheezy', these problems have been fixed in version 3.4.1-3+deb7u3.

We recommend that you upgrade your nagios3 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
234372	RHEL 7 : nagios (RHSA-2017:0214)	Nessus	Red Hat Local Security Checks	critical
105984	Fedora 27 : nagios (2017-d270e932a3)	Nessus	Fedora Local Security Checks	critical
103913	GLSA-201710-20 : Nagios: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
97269	GLSA-201702-26 : Nagios: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
97061	RHEL 6 : nagios (RHSA-2017:0259)	Nessus	Red Hat Local Security Checks	critical
97060	RHEL 7 : nagios (RHSA-2017:0258)	Nessus	Red Hat Local Security Checks	critical
96012	Debian DLA-751-1 : nagios3 security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2016-9565

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical