CVE

Id
70208  
CVE No.
CVE-2014-2913  
Status
Candidate  
Description
** DISPUTED ** Incomplete blacklist vulnerability in nrpe.c in Nagios Remote Plugin Executor (NRPE) 2.15 and earlier allows remote attackers to execute arbitrary commands via a newline character in the -a option to libexec/check_nrpe. NOTE: this issue is disputed by multiple parties. It has been reported that the vendor allows newlines as "expected behavior." Also, this issue can only occur when the administrator enables the "dont_blame_nrpe" option in nrpe.conf despite the "HIGH security risk" warning within the comments.  
Phase
Assigned (20140418)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
669037 70208 CVE-2014-2913 FULLDISC:20140417 NRPE - Nagios Remote Plugin Executor <= 2.15 Remote Command Execution  View
669038 70208 CVE-2014-2913 URL:http://seclists.org/fulldisclosure/2014/Apr/240  View
669039 70208 CVE-2014-2913 FULLDISC:20140418 Re: NRPE - Nagios Remote Plugin Executor <= 2.15 Remote Command Execution  View
669040 70208 CVE-2014-2913 URL:http://seclists.org/fulldisclosure/2014/Apr/242  View
669041 70208 CVE-2014-2913 MLIST:[oss-security] 20140422 Re: CVE Request: Nagios Remote Plugin Executor <= 2.15 Remote Command Execution  View
669042 70208 CVE-2014-2913 URL:http://seclists.org/oss-sec/2014/q2/154  View
669043 70208 CVE-2014-2913 MLIST:[oss-security] 20140422 Re: CVE Request: Nagios Remote Plugin Executor <= 2.15 Remote Command Execution  View
669044 70208 CVE-2014-2913 URL:http://seclists.org/oss-sec/2014/q2/155  View
669045 70208 CVE-2014-2913 FEDORA:FEDORA-2015-15398  View
669046 70208 CVE-2014-2913 URL:http://lists.fedoraproject.org/pipermail/package-announce/2015-September/166528.html  View
669047 70208 CVE-2014-2913 SUSE:openSUSE-SU-2014:0594  View
669048 70208 CVE-2014-2913 URL:http://lists.opensuse.org/opensuse-updates/2014-05/msg00005.html  View
669049 70208 CVE-2014-2913 SUSE:openSUSE-SU-2014:0603  View
669050 70208 CVE-2014-2913 URL:http://lists.opensuse.org/opensuse-updates/2014-05/msg00014.html  View
669051 70208 CVE-2014-2913 SUSE:SUSE-SU-2014:0682  View
669052 70208 CVE-2014-2913 URL:http://lists.opensuse.org/opensuse-security-announce/2014-05/msg00011.html  View
669053 70208 CVE-2014-2913 BID:66969  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
13325 JVNDB-2014-002200 pimcore の Pimcore_Tool_Newsletter モジュールにおける PHP オブジェクトインジェクション攻撃を実行される脆弱性 pimcore の Pimcore_Tool_Newsletter モジュール内の Newsletter.php の getObjectByToken 関数は、Lucene の検索データをアンシリアライズすることで取得されたオブジェクトを適切に処理しないため、PHP オブジェクトインジェクション攻撃を実行される、および任意のコードを実行される脆弱性が存在します。 CVE-2014-2921 70208 7.5 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-002200.html  View