Nagios Core before 4.3.3 creates a nagios.lock PID file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for nagios.lock modification before a root script executes a "kill `cat /pathname/nagios.lock`" command.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Nagios Core before 4.3.3 creates a nagios.lock PID file after dropping privileges to a non-root account,     which might allow local users to kill arbitrary processes by leveraging access to this non-root account     for nagios.lock modification before a root script executes a kill `cat /pathname/nagios.lock` command.
    (CVE-2017-12847)

Note that Nessus relies on the presence of the package as reported by the vendor.

Update to close CVE

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201710-20 (Nagios: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Nagios. Please review       the referenced CVE identifiers for details.
  Impact :

    A remote attacker could possibly escalate privileges to root, thus       allowing the execution of arbitrary code, by leveraging CVE-2016-9565.
      Additionally, a local attacker could cause a Denial of Service condition       against arbitrary processes due to the improper dropping of privileges.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
261400	Linux Distros Unpatched Vulnerability : CVE-2017-12847	Nessus	Misc.	medium
105984	Fedora 27 : nagios (2017-d270e932a3)	Nessus	Fedora Local Security Checks	critical
103913	GLSA-201710-20 : Nagios: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical

Detections

Analytics

CVE-2017-12847

medium

Tenable Plugins

medium

critical

critical