[Pkg-nagios-devel] Bug#745272: Bug#745272: Bug#745272: Exploited by botnet

[Michael Friedrich]

On 30.04.2014 20:15, Alexander Wirt wrote:
> On Wed, 30 Apr 2014, Jan Lühr wrote:
>
>> Hello,
>>
>> there some reports, that these issue is exploited by a bonnet.
>> Please consider pushing security updates.
> As said this is considered a feature by upstream. And to be honest, people
> that are so stupid to allow dont_blame_nrpe + allowed_hosts=0.0.0.0/0
> deserved a heise news entry.
>
> I won't have time in the next days to write a patch for this. And if I would
> do such a patch it will remove dont_blame_nrpe at all for all time.
>
> So if you are interested in getting this nonsense working, feel free to
> provide a patch.

Try the ones attached - it essentially breaks existing modified 
configurations having that option set and will refuse to start the 
daemon if not removed.
Therefore a changelog entry on upgrade would be reasonable imho.

Seems that nagios upstream will never provide a fix as they consider 
nrpe "secure" and security holes as "feature"... (if you find the 
sarcasm, it's free and does not require a do-it-yourself-license)

0001-Reject-dont_blame_nrpe-for-NRPE-daemon-CVE-2014-2913.patch - simply 
disables dont_blame_nrpe and bails out if the option remains set in nrpe.cfg

or

0001-Wipe-dont_blame_nrpe-and-allow_bash_command_substitu.patch - 
entirely remove all related CVE affected code. Did not change configure, 
too many changes between the ancient autoconf 2.59 and 2.69 in testing. 
--enable-command-args is therefore useless, but since it's binary 
packages it doesn't hurt much for debian users here.

hth
Michael



-- 
DI (FH) Michael Friedrich

michael.friedrich at gmail.com  || icinga open source monitoring
https://twitter.com/dnsmichi || lead core developer
dnsmichi at jabber.ccc.de       || https://www.icinga.org/team
irc.freenode.net/icinga      || dnsmichi

-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-Wipe-dont_blame_nrpe-and-allow_bash_command_substitu.patch
Type: text/x-patch
Size: 6967 bytes
Desc: not available
URL: <http://lists.alioth.debian.org/pipermail/pkg-nagios-devel/attachments/20140430/c222f3e2/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-Reject-dont_blame_nrpe-for-NRPE-daemon-CVE-2014-2913.patch
Type: text/x-patch
Size: 2185 bytes
Desc: not available
URL: <http://lists.alioth.debian.org/pipermail/pkg-nagios-devel/attachments/20140430/c222f3e2/attachment-0001.bin>