Description
base/logging.c in Nagios Core before 4.2.4 allows local users with access to an account in the nagios group to gain root privileges via a symlink attack on the log file. NOTE: this can be leveraged by remote attackers using CVE-2016-9565.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 8 | nagios3 | 3.5.1.dfsg-2+deb8u1 | DLA-1615-1 |
| Debian 7 | nagios3 | 3.4.1-3+deb7u3 | DLA-751-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | nagios3 | 3.5.1.dfsg-2.1ubuntu1.1 | USN-3253-1 |
| Ubuntu 14.04 LTS | nagios3 | 3.5.1-1ubuntu1.1 | USN-3253-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 7 | nagios +1 | 3.5.1-9.el7 | RHSA-2017:0214 |
| Red Hat OpenStack 6 | nagios +1 | 3.5.1-9.el7 | RHSA-2017:0213 |
| Red Hat OpenStack 5 | nagios +2 | 3.5.1-9.el6 | RHSA-2017:0212, RHSA-2017:0211 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Gluster Storage 3 | nagios +2 | 3.5.1-9.el6 | RHSA-2017:0259, RHSA-2017:0258 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP5 | sysuser-tools | 2.0-1.9.1 | SUSE-SU-2024:1629-1 |
| SLES 12 SP5 | zeromq | 4.0.4-15.8.1 | SUSE-SU-2024:1629-1 |
| SLES 12 | sysuser-tools | 2.0-1.9.1 | SUSE-SU-2024:1629-1 |
| SLES 12 | zeromq | 4.0.4-15.8.1 | SUSE-SU-2024:1629-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 SP5 | sysuser-tools | 2.0-1.9.1 | SUSE-SU-2024:1629-1 |
| SUSE Manager Client Tools 12 | grafana-ha-cluster-dashboards | 1.1.0+git.1605027022.a84d536-1.10.1 | SUSE-SU-2024:1629-1 |
| SUSE Manager Client Tools 12 | grafana-sap-netweaver-dashboards | 1.0.3+git.1601889366.9f71957-1.10.1 | SUSE-SU-2024:1629-1 |
| SUSE Manager Client Tools 12 | grafana-sap-providers | 1.1-1.7.1 | SUSE-SU-2024:1629-1 |
| SUSE Manager Client Tools 12 | hwdata | 0.314-10.14.1 | SUSE-SU-2024:1629-1 |
| SUSE Manager Client Tools 12 | icinga | 1.13.3-12.6.1 | SUSE-SU-2024:1629-1, SUSE-SU-2022:3576-1 |
| SUSE Manager Client Tools 12 | sysuser-tools | 2.0-1.9.1 | SUSE-SU-2024:1629-1 |
| SUSE Manager Client Tools 12 | zeromq | 4.0.4-15.8.1 | SUSE-SU-2024:1629-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | nagios | 4.4.6-2.5 | openSUSE-SU-2024:11073-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- Nagios < 4.2.4 - Local Privilege Escalation EDB-40921 · local · Dec 15, 2016 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 13
- RHSA-2017:0258 Red Hat Security Advisory: nagios security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2017:0259 Red Hat Security Advisory: nagios security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2017:0214 Red Hat Security Advisory: nagios security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2017:0212 Red Hat Security Advisory: nagios security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2017:0213 Red Hat Security Advisory: nagios security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2017:0211 Red Hat Security Advisory: nagios security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- DLA-751-1 nagios3 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-1615-1 nagios3 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- USN-3253-1 nagios3 vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
- SUSE-SU-2024:1629-1 Security update for SUSE Manager Client Tools Beta SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:3576-1 Security update for icinga SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11073-1 nagios-4.4.6-2.5 on GA media SUSE / openSUSE Security Updates · May 7, 2025
- WID-SEC-2024-1103 Nagios: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 13, 2024
References
- GLSA-201710-20 vendor-advisory
- 40921 exploit
- 94919 vdb-entry
- https://github.com/NagiosEnterprises/nagioscore/commit/c29557dec91eba2306f5fb11b8da4474ba63f8c4
- RHSA-2017:0258 vendor-advisory
- GLSA-201612-51 vendor-advisory
- RHSA-2017:0212 vendor-advisory
- RHSA-2017:0213 vendor-advisory
- https://www.nagios.org/projects/nagios-core/history/4x/
- GLSA-201702-26 vendor-advisory
- [debian-lts-announce] 20181224 [SECURITY] [DLA 1615-1] nagios3 security update mailing-list
- RHSA-2017:0259 vendor-advisory
- 1037487 vdb-entry
- 20161215 Nagios Core < 4.2.4 Root Privilege Escalation [CVE-2016-9566] mailing-list
- https://bugzilla.redhat.com/show_bug.cgi?id=1402869
- https://legalhackers.com/advisories/Nagios-Exploit-Root-PrivEsc-CVE-2016-9566.html
- RHSA-2017:0214 vendor-advisory
- RHSA-2017:0211 vendor-advisory