base/logging.c in Nagios Core before 4.2.4 allows local users with access to an account in the nagios group to gain root privileges via a symlink attack on the log file. NOTE: this can be leveraged by remote attackers using CVE-2016-9565.
Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9566
Reference (s):
- BID:94919
- URL: http://www.securityfocus.com/bid/94919
- https://bugzilla.redhat.com/show_bug.cgi?id=1402869
- https://github.com/NagiosEnterprises/nagioscore/commit/c29557dec91eba2306f5fb11b8da4474ba63f8c4
- https://www.nagios.org/projects/nagios-core/history/4x/