nagios cron job allows privilege escalation from user nagios to root

Vulnerability

A UNIX Symbolic Link (Symlink) Following vulnerability exists in the cron job /etc/cron.weekly/nagios shipped with nagios packages in SUSE Linux Enterprise Server 12 (version 3.5.1-5.27 and prior), SUSE Linux Enterprise Server 11 (version 3.0.6-1.25.36.3.1 and prior), and openSUSE Factory (version 4.4.5-2.1 and prior) [1]. The cron job only activates when NAGIOS_COMPRESS_LOGFILES is set in /etc/sysconfig/nagios [1]. It executes /usr/bin/bzip2 on files matching /var/log/nagios/archives/*.log, but both the archives directory and its parent are owned by the nagios user, allowing creation of symlinks [1]. The bzip2 utility uses stat/lstat/open in a racy manner, enabling symlink following attacks [1].

Exploitation

A local attacker with nagios user privileges can place malicious symlinks or FIFOs in the /var/log/nagios/archives/ directory [1]. No authentication beyond the nagios user is required, as the cron job runs with root privileges but operates on files owned by nagios [1]. The attacker can win a race condition between bzip2's stat and open calls to replace the target file with a symlink [1]. The attacker can also place a FIFO to cause the cron job to hang indefinitely [1].

Impact

Successful exploitation can lead to denial of service by placing a FIFO that blocks bzip2 and thus the cron job [1]. More critically, an attacker can win the race to replace files with symlinks, potentially leaking sensitive information (e.g., compressing /root/.bash_history if group- or world-readable) or corrupting any .log file on the system by directing the archive directory symlink to another directory [1]. Privilege escalation to root is theoretically possible if the race is won to compress a private file and the compressed result is left in an accessible location [1].

Mitigation

A fix requires modifying the cron job to run commands in the nagios user context, e.g., via sudo, preventing the race condition [1]. No patched version is explicitly listed in the available references; users should monitor SUSE advisories for updates [1]. As a workaround, ensure NAGIOS_COMPRESS_LOGFILES is not set in /etc/sysconfig/nagios to keep the cron job inactive [1].