Incomplete blacklist vulnerability in nrpc.c in Nagios Remote Plug-In Executor (NRPE) before 2.14 might allow remote attackers to execute arbitrary shell commands via "$()" shell metacharacters, which are processed by bash.

The remote host is affected by the vulnerability described in GLSA-201408-18 (NRPE: Multiple Vulnerabilities)

    Multiple vulnerabilities have been discovered in NRPE. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker can utilize multiple vectors to execute arbitrary       code.
  Workaround :

    There is no known workaround at this time.

NRPE (the Nagios Remote Plug-In Executor) allows the passing of $() to plugins/scripts which, if run under bash, will execute that shell command under a subprocess and pass the output as a parameter to the called script. Using this, it is possible to get called scripts, such as check_http, to execute arbitrary commands under the uid that NRPE/nagios is running as (typically, 'nagios').

With this update NRPE will deny remote requests containing a bash command substitution.

Incomplete blacklist vulnerability in nrpc.c in Nagios Remote Plug-In Executor (NRPE) before 2.14 might allow remote attackers to execute arbitrary shell commands via '$()' shell metacharacters, which are processed by bash.

Nagios NRPE was updated to add more blacklisting to avoid shell injection via nagios request packets. (CVE-2013-1362)

Update to 2.14 upstream for security fix and misc other bugfixes.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to 2.14 upstream for security fix and misc other bugfixes.
Fixes a mistake in the service file which prevented the NRPE daemon from being started

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to 2.14 upstream to fix security issue. Misc other bugfixes.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running a version of Nagios NRPE that contains a flaw that is triggered when input passed via '$()' is not properly sanitized before being used to execute plugins.

An unauthenticated, remote attacker could exploit this issue to execute arbitrary commands within the context of the vulnerable application.

ID	Name	Product	Family	Severity
77462	GLSA-201408-18 : NRPE: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	high
74957	openSUSE Security Update : nagios-nrpe (openSUSE-SU-2013:0621-1)	Nessus	SuSE Local Security Checks	high
69761	Amazon Linux AMI : nrpe (ALAS-2013-203)	Nessus	Amazon Linux Local Security Checks	high
68980	SuSE 11.2 / 11.3 Security Update : nagios-nrpe, nagios-plugins-nrpe (SAT Patch Numbers 8032 / 8033)	Nessus	SuSE Local Security Checks	high
67388	Fedora 18 : nrpe-2.14-3.fc18 (2013-9848)	Nessus	Fedora Local Security Checks	high
67387	Fedora 17 : nrpe-2.14-3.fc17 (2013-9836)	Nessus	Fedora Local Security Checks	high
67386	Fedora 19 : nrpe-2.14-3.fc19 (2013-9829)	Nessus	Fedora Local Security Checks	high
66361	Nagios NRPE nrpe.c Arbitrary Command Execution	Nessus	Misc.	high

Detections

Analytics

CVE-2013-1362

critical

Tenable Plugins

high

high

high

high

high

high

high

high