CVE-2014-2913: High severity Nagios Remote Plugin Executor vulnerability
DISPUTED Incomplete blacklist vulnerability in nrpe.c in Nagios Remote Plugin Executor (NRPE) 2.15 and earlier allows remote attackers to execute arbitrary commands via a newline character in the -a option to libexec/checknrpe. NOTE: this issue is disputed by multiple parties. It has been reported that the vendor allows newlines as "expected behavior." Also, this issue can only occur when the administrator enables the "dontblamenrpe" option in nrpe.conf despite the "HIGH security risk" warning within the comments.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-2913?
CVE-2014-2913 is disputed in terms of its severity, but it allows remote attackers to execute arbitrary commands due to incomplete input validation.
How do I fix CVE-2014-2913?
To fix CVE-2014-2913, upgrade to a version of Nagios Remote Plugin Executor that is later than 2.15, as older versions are vulnerable.
Which versions of software are affected by CVE-2014-2913?
CVE-2014-2913 affects Nagios Remote Plugin Executor versions up to and including 2.15 and specific versions of openSUSE.
Can CVE-2014-2913 lead to command execution?
Yes, CVE-2014-2913 allows remote attackers to execute arbitrary commands by exploiting the newline character in the -a option.
Is CVE-2014-2913 considered a critical vulnerability?
While CVE-2014-2913 poses a significant risk due to potential command execution, its criticality has been disputed by various parties.