Cross-site scripting (XSS) vulnerability in Nagios.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - nagios: Unsafe ownership change leading to privilege escalation (CVE-2016-8641)

  - Cross-site scripting (XSS) vulnerability in Nagios. (CVE-2016-6209)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - nagios: Configured administrative account with fixed password and no IP restriction as default     (CVE-2016-0726)

  - Cross-site scripting (XSS) vulnerability in Nagios. (CVE-2016-6209)

  - A privilege escalation vulnerability was found in nagios 4.2.x that occurs in daemon-init.in when creating     necessary files and insecurely changing the ownership afterwards. It's possible for the local attacker to     create symbolic links before the files are to be created and possibly escalating the privileges with the     ownership change. (CVE-2016-8641)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

This update for nagios fixes the following issues :

  - new nagios-exec-start-post script to fix boo#1003362

  - fix nagios_upgrade.sh writing to log file in user     controlled directory (boo#1182398). The     nagios_upgrade.sh script writes the logfile directly     below /var/log/ 

nagios was updated to 4.4.6 :

  - Fixed Map display in Internet Explorer 11 (#714)

  - Fixed duplicate properties appearing in statusjson.cgi     (#718)

  - Fixed NERD not building when enabled in ./configure     (#723)

  - Fixed build process when using GCC 10 (#721)

  - Fixed postauth vulnerabilities in histogram.js, map.js,     trends.js (CVE-2020-13977, boo#1172794)

  - When using systemd, configuration will be verified     before reloading (#715)

  - Fixed HARD OK states triggering on the maximum check     attempt (#757)

  - Fix for CVE-2016-6209 (boo#989759) - The 'corewindow'     parameter (as in bringing this to our attention go to     Dawid Golunski (boo#1014637)

Update to close CVE

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
198689	RHEL 7 : nagios (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
198658	RHEL 6 : nagios (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
195400	RHEL 7 : nagios (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
195343	RHEL 6 : nagios (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
149530	openSUSE Security Update : nagios (openSUSE-2021-715)	Nessus	SuSE Local Security Checks	medium
105984	Fedora 27 : nagios (2017-d270e932a3)	Nessus	Fedora Local Security Checks	critical

Detections

Analytics

CVE-2016-6209

medium

Tenable Plugins

high

critical

high

high

medium

critical