Nagios CVE-2013-4214 Insecure Temporary File Creation Vulnerability

Bugtraq ID:	61747
Class:	Design Error
CVE:	CVE-2013-4214
Remote:	No
Local:	Yes
Published:	Aug 07 2013 12:00AM
Updated:	Oct 26 2016 04:01AM
Credit:	Grant Murphy
Vulnerable:	Redhat OpenStack 3.0 Nagios Nagios 3.4.4 IBM PowerKVM 3.1 IBM PowerKVM 2.1
Not Vulnerable:

Nagios CVE-2013-4214 Insecure Temporary File Creation Vulnerability

Nagios is prone to an insecure temporary-file-creation vulnerability.

Local attackers may be able to perform symbolic-link attacks to overwrite arbitrary files in the context of the affected application. Other attacks may also be possible.

Nagios CVE-2013-4214 Insecure Temporary File Creation Vulnerability

Attackers require local interactive access to exploit this issue.

Nagios CVE-2013-4214 Insecure Temporary File Creation Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Nagios CVE-2013-4214 Insecure Temporary File Creation Vulnerability

References:

• CVE-2013-4214 Nagios core: html/rss-newsfeed.php insecure temporary file usage (Red Hat)
  
• Nagios Homepage (Nagios)
  
• isg3T1024264: Security Bulletin: Vulnerabilities in nagios affect PowerKVM (IBM)