CVE-2013-4214 - core: html/rss-newsfeed.php insecure temporary file usage

Back Back to CVE browser

MEDIUM

core: html/rss-newsfeed.php insecure temporary file usage

Published Nov 23, 2013

6.3

MEDIUM

CVSS 2.0

EPSS 0.36%

Description

rss-newsfeed.php in Nagios Core 3.4.4, 3.5.1, and earlier, when MAGPIE_CACHE_ON is set to 1, allows local users to overwrite arbitrary files via a symlink attack on /tmp/magpie_cache.

Affected products

OpenStack 3 for RHEL 6

nagios-0:3.5.1-2.el6ost

Fixed · RHSA-2013:1526
Red Hat Mobile Application Platform 4

nagios

Not affected
Red Hat OpenStack Platform 4

nagios

Affected

Product	Package	State	Advisory
OpenStack 3 for RHEL 6	nagios-0:3.5.1-2.el6ost	Fixed	RHSA-2013:1526
Red Hat Mobile Application Platform 4	nagios	Not affected	n/a
Red Hat OpenStack Platform 4	nagios	Affected	n/a

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-377

CWE-59

References (7)

http://rhn.redhat.com/errata/RHSA-2013-1526.html
vendor-advisoryx_refsource_REDHATVendor Advisory
http://www.securityfocus.com/bid/61747
vdb-entryx_refsource_BID
https://access.redhat.com/security/cve/CVE-2013-4214
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=958002
x_refsource_CONFIRMIssue Tracking
https://nvd.nist.gov/vuln/detail/CVE-2013-4214
https://www.cve.org/CVERecord?id=CVE-2013-4214
https://www.nagios.org/projects/nagios-core/history/4x/
x_refsource_CONFIRM

Link	Providers	Tags
http://rhn.redhat.com/errata/RHSA-2013-1526.html		vendor-advisoryx_refsource_REDHATVendor Advisory
http://www.securityfocus.com/bid/61747		vdb-entryx_refsource_BID
https://access.redhat.com/security/cve/CVE-2013-4214		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=958002		x_refsource_CONFIRMIssue Tracking
https://nvd.nist.gov/vuln/detail/CVE-2013-4214
https://www.cve.org/CVERecord?id=CVE-2013-4214
https://www.nagios.org/projects/nagios-core/history/4x/		x_refsource_CONFIRM