CVE-2014-2913
- State
- Published
- Severity
- Not scored
- Published
- May 7, 2014
- Updated
- Aug 6, 2024
- Reserved
- Apr 18, 2014
Description
Incomplete blacklist vulnerability in nrpe.c in Nagios Remote Plugin Executor (NRPE) 2.15 and earlier allows remote attackers to execute arbitrary commands via a newline character in the -a option to libexec/check_nrpe. NOTE: this issue is disputed by multiple parties. It has been reported that the vendor allows newlines as "expected behavior." Also, this issue can only occur when the administrator enables the "dont_blame_nrpe" option in nrpe.conf despite the "HIGH security risk" warning within the comments
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- openSUSE-SU-2014:0603vendor-advisory
- 66969vdb-entry
- [oss-security] 20140422 Re: CVE Request: Nagios Remote Plugin Executor <= 2.15 Remote Command Executionmailing-list
- FEDORA-2015-15398vendor-advisory
- openSUSE-SU-2014:0594vendor-advisory
- SUSE-SU-2014:0682vendor-advisory
- [oss-security] 20140422 Re: CVE Request: Nagios Remote Plugin Executor <= 2.15 Remote Command Executionmailing-list
- 20140417 NRPE - Nagios Remote Plugin Executor <= 2.15 Remote Command Executionmailing-list
- 20140418 Re: NRPE - Nagios Remote Plugin Executor <= 2.15 Remote Command Executionmailing-list
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.