Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale.
Voir CVE-2018-6536 →
DEBIAN-CVE-2018-6536
An issue was discovered in Icinga 2.x through 2.8.1. The daemon creates an icinga2.pid file after dropping privileges to a non-root account, which mig...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
An issue was discovered in Icinga 2.x through 2.8.1. The daemon creates an icinga2.pid file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for icinga2.pid modification before a root script executes a "kill cat /pathname/icinga2.pid" command, as demonstrated by icinga2.init.d.cmake.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Paquets affectés
Debian:12
icinga2
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.4-1"}]}]
Debian:13
icinga2
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.4-1"}]}]
Debian:14
icinga2
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.4-1"}]}]
Références
- advisory security-tracker.debian.org