Branch c8.1 update bulletin.

Package nagios-nrpe updated to version 3.1.1-alt0.M80C.3 for branch c8.1 in task 211367.

Published: 2018-08-01

BDU:2019-01845

Уязвимость утилиты удалённого выполнения плагинов Nagios Remote Plugin Executor, связанная с недостаточной проверкой входных данных, позволяющая нарушителю выполнить произвольный код

Severity: HIGH (7.3) Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

References:

CVE-2014-2913

Published: 2014-05-07
Modified: 2024-11-21

CVE-2014-2913

Incomplete blacklist vulnerability in nrpe.c in Nagios Remote Plugin Executor (NRPE) 2.15 and earlier allows remote attackers to execute arbitrary commands via a newline character in the -a option to libexec/check_nrpe. NOTE: this issue is disputed by multiple parties. It has been reported that the vendor allows newlines as "expected behavior." Also, this issue can only occur when the administrator enables the "dont_blame_nrpe" option in nrpe.conf despite the "HIGH security risk" warning within the comments

Severity: HIGH (7.5)

References:

Version: 2.1.0

Branch c8.1 update on 2018-09-15

ALT-BU-2018-3462-1

ALT-PU-2018-2318-1

Closed vulnerabilities

BDU:2019-01845

CVE-2014-2913