Title: pnp4nagios root privilege escalation via insecure permissions
Author: Michael Orlitzky
Fixedin: Commit 23c123f
Summary
The pnp4nagios build system installs two sets of files with insecure permissions. After installation, the executables and the configuration files are all owned by the same unprivileged user and group (typically, nagios) that the npcd daemon runs as. In one attack, the unprivileged user simply replaces the npcd executable with one that does his bidding. A slightly more complicated attack can be mounted by the unprivileged user by configuring a malicious action and then altering npcd.cfg to execute that action as root.
Learn More
Complete details here: http://michael.orlitzky.com/cves/cve-2017-16834.xhtml
For more information, call: 410-667-3600
What is CVE?
Common Vulnerabilities and Exposures (CVE®) is a list of common identifiers for publicly known cybersecurity vulnerabilities, and is the industry standard for vulnerability and exposure identifiers.
The process of creating a CVE Entry begins with the discovery of a potential security vulnerability. The MITRE Corporation currently maintains CVE and this public website, oversees the CNAs and CVE Board, and provides impartial technical guidance throughout the process to ensure CVE serves the public interest.
About Metro Data, Inc.
Founded in 1994, Metro Data, Inc. is a leading information systems & services firm that works exclusively with business clients to develop and apply customized technology solutions that accomplish a client's strategic goals.
Businesses have chosen Metro Data, Inc. to help keep pace with the ever-changing technology landscape. Metro Data, Inc.’s "end-to-end" experience helps their customers to secure their systems, reduce costs, and improve their business information systems performance.
About the CVE Author, Michael J. Orlitzky
Mike has been with Metro Data, Inc. for over 20 years. He holds a PhD in Mathematics. He has been globally recognized for his work in discovering (and fixing) vulnerabilities in operating systems and application software. His research has been published in professional journals and he's been acknowledged by industry and academic peers for his work.
