Threats Tagged 'ghsa-r35r-fpx2-jgr4'

Linuxfabrik Monitoring Plugins create SQLite databases at predictable static paths in /tmp, allowing any user to create symlinks at these paths. When the monitoring scripts run, especially with sudo privileges, they follow these symlinks and create or modify databases at arbitrary locations. This can lead to denial of service or unauthorized modification of SQLite database files if an attacker has compromised the nagios user account. The vulnerability affects versions prior to 4.2.0. A proposed fix involves creating per-user directories in /tmp with strict ownership and permission checks to prevent symlink attacks.