CVE-2017-14955

What it actually does

Race condition in failed-login error handling allows GUI crash reports to contain sensitive user data such as credentials or session information.

Why it matters to the business

Attackers may obtain user credentials or other sensitive information, enabling further unauthorized access, account takeover, or data exposure in monitoring environments.

How an attack unfolds

An attacker triggers repeated failed login attempts in a timing window that exploits the race condition, causing the generation of a GUI crash report that inadvertently includes sensitive user information which the attacker then reads.

How to fix it

Upgrade Check_MK to version 1.2.8p26 or later to correct the race condition in failed-login handling.

How to confirm the fix worked

Confirm the installed version is 1.2.8p26 or newer; attempt failed logins under load and verify that generated reports no longer contain sensitive user fields.

Typical attack path

1. Perform multiple failed authentication attempts against the Check_MK GUI
2. Force an error condition during the failed-login save operation
3. Access the resulting crash report via the web interface or file system
4. Extract sensitive user data from the report contents

How to detect it

Review web server and application logs for sequences of failed logins followed by access to crash report files or endpoints; look for unexpected reads of temporary error files shortly after authentication failures.

What your security team should do

• Upgrade all Check_MK instances to 1.2.8p26 or later as soon as possible
• Restrict access to GUI crash reports to administrators only
• Enable logging of report generation and review for anomalous access patterns