CVE-2014-2913
First published: Wed May 07 2014(Updated: )
** DISPUTED ** Incomplete blacklist vulnerability in nrpe.c in Nagios Remote Plugin Executor (NRPE) 2.15 and earlier allows remote attackers to execute arbitrary commands via a newline character in the -a option to libexec/check_nrpe. NOTE: this issue is disputed by multiple parties. It has been reported that the vendor allows newlines as "expected behavior." Also, this issue can only occur when the administrator enables the "dont_blame_nrpe" option in nrpe.conf despite the "HIGH security risk" warning within the comments.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Nagios Remote Plugin Executor | <=2.15 | |
| openSUSE openSUSE | =11.4 | |
| openSUSE openSUSE | =12.3 | |
| openSUSE openSUSE | =13.1 | |
| <=2.15 | ||
| =11.4 | ||
| =12.3 | ||
| =13.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://lists.fedoraproject.org/pipermail/package-announce/2015-September/166528.html
- http://lists.opensuse.org/opensuse-security-announce/2014-05/msg00011.html
- http://lists.opensuse.org/opensuse-updates/2014-05/msg00005.html
- http://lists.opensuse.org/opensuse-updates/2014-05/msg00014.html
- http://seclists.org/fulldisclosure/2014/Apr/240
- http://seclists.org/fulldisclosure/2014/Apr/242
- http://seclists.org/oss-sec/2014/q2/154
- http://seclists.org/oss-sec/2014/q2/155
- http://www.securityfocus.com/bid/66969
- agent/type
- agent/first-publish-date
- agent/author
- agent/references
- agent/severity
- agent/status
- agent/description
- agent/event
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/softwarecombine
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/last-modified-date
- collector/mitre-cve
- source/MITRE
- status/disputed
- vendor/nagios
- canonical/nagios remote plugin executor
- version/nagios remote plugin executor/2.15
- vendor/opensuse
- canonical/opensuse opensuse
- version/opensuse opensuse/11.4
- version/opensuse opensuse/12.3
- version/opensuse opensuse/13.1