CVE-2019-3698 : Security Advisory and Response

A vulnerability has been discovered in the cronjob included in the nagios software of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 11, and openSUSE Factory. This vulnerability allows local attackers to potentially disrupt the system or gain elevated privileges by exploiting a race condition.

Understanding CVE-2019-3698

This CVE identifies a privilege escalation vulnerability in the nagios cron job on SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 11, and openSUSE Factory.

What is CVE-2019-3698?

CVE-2019-3698 is a UNIX Symbolic Link (Symlink) Following vulnerability in the cronjob shipped with nagios of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 11, and openSUSE Factory. It enables local attackers to cause a Denial of Service (DoS) or potentially escalate privileges by exploiting a race condition.

The Impact of CVE-2019-3698

CVSS Base Score: 5.7 (Medium Severity)
Attack Vector: Local
Attack Complexity: High
Confidentiality Impact: High
Integrity Impact: None
Availability Impact: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged

Technical Details of CVE-2019-3698

This section provides detailed technical information about the vulnerability.

Vulnerability Description

The vulnerability allows local attackers to escalate privileges from the nagios user to root by exploiting a race condition in the cronjob.

Affected Systems and Versions

The following systems and versions are affected:

SUSE Linux Enterprise Server 12 with nagios version 3.5.1-5.27 and earlier
SUSE Linux Enterprise Server 11 with nagios version 3.0.6-1.25.36.3.1 and earlier
openSUSE Factory with nagios version 4.4.5-2.1 and earlier

Exploitation Mechanism

Attackers can exploit the vulnerability by manipulating symbolic links in the cronjob, leading to privilege escalation from the nagios user to root.

Mitigation and Prevention

To address CVE-2019-3698, follow these mitigation strategies:

Immediate Steps to Take

Apply the latest security patches provided by the vendor
Monitor system logs for any suspicious activities
Restrict access to critical system files and directories

Long-Term Security Practices

Conduct regular security audits and vulnerability assessments
Implement the principle of least privilege for user accounts
Educate users on safe computing practices

Patching and Updates

Update nagios to the patched versions to eliminate the vulnerability