CVE-2017-12847: nagios Improper Initialization
CVSS: 6.3v3.0MediumModified
AliasesMGASA-2017-0437UBUNTU-CVE-2017-12847
Published 23-08-2017Last modified 05-08-2024
Vulnerability summary
CVE-2017-12847 is a medium (CVSS 6.3) Improper Initialization vulnerability in nagios. EPSS estimates a 0.79% chance of exploitation in the next 30 days, higher than 55.3% of scored vulnerabilities.
CVSS score
6.3/10
010
Medium · v3.0 (NVD)EPSS score
0.79%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 23-08-2017PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
Nagios Core before 4.3.3 creates a nagios.lock PID file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for nagios.lock modification before a root script executes a "kill `cat /pathname/nagios.lock`" command.
CVSS metrics
3 scores · 2 sources · 2 versionsMedium 6.3Preferred score · NVD (NIST)
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:HSourcesAll 2 agree
- OSV · UbuntuEcosystem advisory · calculated6.3MediumCVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H
Medium 6.3Preferred score · NVD (NIST)
AV:L/AC:M/Au:N/C:N/I:C/A:CSourcesSingle source
EPSS trend
Probability
0.79%
Chance of exploitation in the next 30 days
Percentile
55%
Versus all other CVEs
30-day change
0.00 pp
From 0.79% on 19-09-2026
19-09-202619-10-2026
EPSS score0.79%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Mageia1 product
- nagios< 4.3.1-2.1.mga6
Nagios1 product
- nagios≤ 4.3.2
Ubuntu1 product
- nagios3All versions (No fix recorded)
3 vendors · 3 products
References
12 links- github.com/NagiosEnterprises/nagioscore/commit/3baffa78bafebbbdf9f448890ba5a952ea2d73cbX Refsource CONFIRMPatchVendor Advisory
- github.com/NagiosEnterprises/nagioscore/commit/1b197346d490df2e2d3b1dcce5ac6134ad0c8752X Refsource CONFIRMPatchVendor Advisory
- github.com/NagiosEnterprises/nagioscore/blob/master/ChangelogX Refsource CONFIRMRelease NotesVendor Advisory