Medium
Security advisory
Nagios Core before 4.3.3 creates a nagios.lock PID file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for nagios.lock modification before a root script executes a "kill `cat /pathname/nagios.lock`" command.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2017-12847
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 12:12 UTC · Revision 1
Source evidence
Nagios Core before 4.3.3 creates a nagios.lock PID file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for nagios.lock modification before a root script executes a "kill `cat /pathname/nagios.lock`" command.
osv:CVE-2017-12847
Complete source record
{
"id": "6b5cdef337b3d9924034d9a1c69ee4f9a7331dfd805f9db80c8e7b4763279a4d",
"url": "https://osv.dev/vulnerability/CVE-2017-12847",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2017-12847",
"summary": "Nagios Core before 4.3.3 creates a nagios.lock PID file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for nagios.lock modification before a root script executes a \"kill `cat /pathname/nagios.lock`\" command.",
"evidence": "osv:CVE-2017-12847",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2017-12847",
"aliases": [
"CVE-2017-12847"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/nagiosenterprises/nagioscore",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"last_affected": "2e4212c70dda568e4bf0393435bc6ab0864994e7"
},
{
"fixed": "1b197346d490df2e2d3b1dcce5ac6134ad0c8752"
},
{
"fixed": "3baffa78bafebbbdf9f448890ba5a952ea2d73cb"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:nagios:nagios:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"last_affected": "4.3.2"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "1b197346d490df2e2d3b1dcce5ac6134ad0c8752"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "3baffa78bafebbbdf9f448890ba5a952ea2d73cb"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"nagios-4.3.2",
"nagios-4.3.1",
"release-4.3.0",
"nagios-4.3.0",
"release-4.2.4",
"nagios-4.2.2",
"4.2.1",
"nagios-4.1.1",
"nagios-4.1.0",
"nagios-4.1.0rc2",
"nagios-4.0.6",
"nagios-4.0.5",
"nagios-4.0.4",
"nagios-4.0.0",
"nagios-4.0.0-beta4",
"nagios-4.0.0-beta3",
"nagios-4.0.0-beta2",
"nagios-4.0.0-beta1",
"nagios-3.4.1",
"nagios-3.4.0",
"nagios-3.3.1",
"nagios-3.2.3",
"nagios-3.2.2",
"nagios-3.2.1",
"nagios-3.2.0",
"nagios-3.1.2",
"nagios-3.1.1",
"nagios-3.1.0",
"nagios-3.0.6",
"nagios-3.0.5",
"nagios-3.0.4",
"nagios-3.0.3",
"nagios-3.0.2",
"nagios-3.0.1",
"nagios-3.0",
"nagios-3.0rc3",
"nagios-3.0rc2",
"nagios-3.0rc1",
"nagios-3.0b7",
"nagios-3.0b6",
"nagios-3.0b5",
"nagios-3.0b4",
"nagios-3.0b3",
"nagios-3.0b2",
"nagios-3.0b1",
"nagios-3.0a5",
"nagios-3.0a4",
"nagios-3.0a3",
"nagios-3.0a2",
"nagios-3.0a1",
"nagios-2.0",
"nagios-2.0rc1",
"nagios-2.0b6",
"nagios-2.0.b5",
"nagios-2.0b4",
"nagios-2.0b3",
"nagios-2.0b2",
"nagios-2.0b1",
"nagios-1.0b6",
"nagios-1.0b5",
"nagios-1.0b4",
"nagios-1.0b3",
"nagios-1.0b2",
"nagios-1.0b1",
"nagios-1.0a7",
"nagios-1.0a6"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-12847.json",
"vanir_signatures": [
{
"id": "CVE-2017-12847-1c71215f",
"digest": {
"threshold": 0.9,
"line_hashes": [
"18166993775096451283999305342393905517",
"323285575529554466441180117519626675682",
"302534000399466920953880950409099860418",
"224454027163474106003223621063889339353",
"136183904707565155328563958712168354046",
"265106673575102192321822654067499560795",
"169704132406692230459444399014392071239",
"99320945942352524122598772702530167798",
"222776566464554068020891999008718271011",
"184054446001580763048825606566453869192",
"278528254558251760976394294382491493241",
"188647213713844536507083633210708505557",
"222291352107249277855673226898122059471",
"99719521977677722006786535212271976493",
"37644059831282870098599897202419719148",
"334925305892522566529414181630766856783"
]
},
"source": "https://github.com/nagiosenterprises/nagioscore/commit/1b197346d490df2e2d3b1dcce5ac6134ad0c8752",
"target": {
"file": "base/nagios.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2017-12847-ff6f8b6d",
"digest": {
"length": 15757,
"function_hash": "163218892130331372729747023081253370699"
},
"source": "https://github.com/nagiosenterprises/nagioscore/commit/1b197346d490df2e2d3b1dcce5ac6134ad0c8752",
"target": {
"file": "base/nagios.c",
"function": "main"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-20T13:19:05Z"
}
}
],
"modified": "2026-10-20T13:19:05.430285629Z",
"provider": "osv",
"references": [
"https://github.com/NagiosEnterprises/nagioscore/blob/master/Changelog",
"https://security.gentoo.org/glsa/201710-20",
"https://github.com/NagiosEnterprises/nagioscore/issues/404",
"https://github.com/NagiosEnterprises/nagioscore/commit/1b197346d490df2e2d3b1dcce5ac6134ad0c8752",
"https://github.com/NagiosEnterprises/nagioscore/commit/3baffa78bafebbbdf9f448890ba5a952ea2d73cb"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2017-12847",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 387495,
"published_at": "2017-08-23T21:29:00.2+00:00"
}