[Pkg-nagios-devel] Bug#745272: NRPE - Nagios Remote Plugin Executor <= 2.15 Remote CommandExecution, POC released

[Markus Manzke]

Package: nagios-nrpe-server
Severity: critical
Tags: security

NRPE fails to check input when a newline-character is issued

POC has been released and works on debian 7, no CVE assigned yet

http://seclists.org/fulldisclosure/2014/Apr/240
http://seclists.org/oss-sec/2014/q2/136



-- System Information:
Debian Release: 7.4
  APT prefers stable-updates
  APT policy: (500, 'stable-updates'), (500, 'stable')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 3.2.0-4-amd64 (SMP w/2 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash

Versions of packages nagios-nrpe-server depends on:
ii  adduser      3.113+nmu3
ii  libc6        2.13-38+deb7u1
ii  libssl1.0.0  1.0.1e-2+deb7u4
ii  libwrap0     7.6.q-24
ii  lsb-base     4.1+Debian8+deb7u1

Versions of packages nagios-nrpe-server recommends:
ii  nagios-plugins        1.4.16-1
ii  nagios-plugins-basic  1.4.16-1

nagios-nrpe-server suggests no packages.