CVE-2017-12847: Medium severity nagios plugins vulnerability
Published Aug 23, 2017
·Updated
Nagios Core before 4.3.3 creates a nagios.lock PID file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for nagios.lock modification before a root script executes a "kill cat /pathname/nagios.lock" command.
Affected Software
1 affected component
Nagios nagios<=4.3.2
Remediation
Event History
Aug 23, 2017
CVE Published
via MITRE·09:00 PM
Data Sourced
via MITRE·09:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2017-12847?
CVE-2017-12847 has a medium severity rating due to the potential for local privilege escalation.
2
How do I fix CVE-2017-12847?
To fix CVE-2017-12847, upgrade to Nagios Core version 4.3.3 or later.
3
What software is affected by CVE-2017-12847?
CVE-2017-12847 affects Nagios Core versions prior to 4.3.3.
4
Can CVE-2017-12847 be exploited remotely?
No, CVE-2017-12847 is a local privilege escalation vulnerability that requires local access.
5
Who can exploit CVE-2017-12847?
Local users with access to a non-root account can exploit CVE-2017-12847 to kill arbitrary processes.