rss-newsfeed.php in Nagios Core 3.4.4, 3.5.1, and earlier, when MAGPIE_CACHE_ON is set to 1, allows local users to overwrite arbitrary files via a symlink attack on /tmp/magpie_cache.
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Nagios | Nagios | * | 3.5.1 (including) |
| Nagios | Nagios | 3.4.4 (including) | 3.4.4 (including) |
| Openstack | Redhat | 3.0 (including) | 3.0 (including) |
| OpenStack 3 for RHEL 6 | RedHat | nagios-0:3.5.1-2.el6ost | * |
| Nagios3 | Ubuntu | quantal | * |
| Nagios3 | Ubuntu | raring | * |
| Nagios3 | Ubuntu | saucy | * |
| Nagios3 | Ubuntu | upstream | * |