The Linuxfabrik Monitoring Plugins include a sudoers file that permits the nagios user to run /usr/bin/apt-get via sudo without restricting command arguments. This allows an attacker with access to the nagios user to escalate privileges to root by passing crafted apt-get arguments that execute arbitrary shell commands. For example, running 'sudo apt-get update -o APT::Update::Pre-Invoke::="/bin/sh"' spawns a root shell. The vulnerability is a local privilege escalation (CWE-88) affecting versions of linuxfabrik-lib prior to 5.1.0. The recommended fix is to restrict the allowed apt-get commands and arguments in the sudoers file to only those necessary for the monitoring plugins.

This vulnerability allows a local attacker who has already compromised the nagios user account to escalate privileges to root by abusing unrestricted apt-get command arguments allowed in sudoers. The impact is high as it results in full root access on the affected system. However, exploitation requires prior access to the nagios user, which is a significant precondition.

A patch is available that restricts the allowed apt-get commands and arguments in the sudoers file to only those specifically needed by the monitoring plugins. Users should update to linuxfabrik-lib version 5.1.0 or later. Until patched, manually restrict the sudoers entry for apt-get to only allow specific arguments, such as 'apt-get update --quiet 2', to prevent arbitrary command execution. No other mitigation is indicated by the vendor advisory.