Nagios XI: systemd unit files shipped with unnecessary executable permissions

Impact

Nagios XI before 2024R1.4.2 installs systemd unit files, notably nagios.service, with permission bits broader than needed - the unit is marked executable. On its own this grants nothing; it widens local attack surface by allowing unintended execution behaviour and makes abuse of service operations easier when chained with another local weakness on the monitoring host. That host matters more than its CVSS suggests: a datacenter Nagios XI box typically holds SSH keys, SNMP and IPMI credentials for the fleet it polls, so anything that eases local escalation there is worth closing.

Who can reach it

A local user with a shell on the Nagios XI server. No remote path, and no impact by itself - it is a hardening defect that helps an attacker who already has local access.

What to do

Upgrade Nagios XI to 2024R1.4.2 or later, which corrects the shipped permissions; the upgrade restarts the monitoring daemons and briefly interrupts polling. If an upgrade is not scheduled, the bits can be corrected in place (remove the executable bit from the unit files under the Nagios unit directory) followed by systemctl daemon-reload. No reboot.

References

Related entries

• Keycloak: OIDC authentication flaw - attacker reusing data from a same-realm request impersonates a userCVE-2023-0264 · KeycloakMedium
• MySQL Server: InnoDB flaw allowing a high-privileged network attacker to cause a repeatable DoSCVE-2022-21417 · MySQL ServerMedium
• MySQL Server: InnoDB flaw - a high-privileged network attacker can hang or repeatedly crash the serverCVE-2023-22084 · MySQL ServerMedium
• RabbitMQ: HTTP API enforces no request body limitCVE-2023-46118 · RabbitMQMedium
• Elasticsearch: elasticsearch-certutil --csr writes the private key to disk unencrypted despite --passCVE-2024-23444 · ElasticsearchMedium
• Linux perf/x86/amd - race between amd_pmu_enable_all, perf NMI and throttling: A race between AMD PMU enablementCVE-2022-49781 · Linux perf/x86/amd - race between amd_pmu_enable_all, perf NMI and throttlingMedium