Vulnerability Name:

CVE-2014-2913 (CCN-92691)

Assigned:2014-04-17
Published:2014-04-17
Updated:2018-10-30
Summary:** DISPUTED ** Incomplete blacklist vulnerability in nrpe.c in Nagios Remote Plugin Executor (NRPE) 2.15 and earlier allows remote attackers to execute arbitrary commands via a newline character in the -a option to libexec/check_nrpe.
Note: this issue is disputed by multiple parties. It has been reported that the vendor allows newlines as "expected behavior." Also, this issue can only occur when the administrator enables the "dont_blame_nrpe" option in nrpe.conf despite the "HIGH security risk" warning within the comments.
Per: http://cwe.mitre.org/data/definitions/184.html

"CWE-184: Incomplete Blacklist"
CVSS v3 Severity:7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): Low
CVSS v2 Severity:7.5 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
6.4 Medium (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:U/RC:UR)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
7.5 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
6.4 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:U/RC:UR)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
Vulnerability Type:CWE-Other
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2014-2913

Source: FEDORA
Type: UNKNOWN
FEDORA-2015-15398

Source: SUSE
Type: UNKNOWN
SUSE-SU-2014:0682

Source: SUSE
Type: UNKNOWN
openSUSE-SU-2014:0594

Source: SUSE
Type: UNKNOWN
openSUSE-SU-2014:0603

Source: FULLDISC
Type: Exploit
20140417 NRPE - Nagios Remote Plugin Executor <= 2.15 Remote Command Execution

Source: FULLDISC
Type: Exploit
20140418 Re: NRPE - Nagios Remote Plugin Executor <= 2.15 Remote Command Execution

Source: MLIST
Type: UNKNOWN
[oss-security] 20140422 Re: CVE Request: Nagios Remote Plugin Executor <= 2.15 Remote Command Execution

Source: MLIST
Type: UNKNOWN
[oss-security] 20140422 Re: CVE Request: Nagios Remote Plugin Executor <= 2.15 Remote Command Execution

Source: CCN
Type: IBM Security Bulletin T1024235 (PowerKVM)
A vulnerability in NRPE affects PowerKVM (CVE-2014-2913)

Source: CCN
Type: Nagios Web site
Remote Plugin Executor

Source: BID
Type: UNKNOWN
66969

Source: CCN
Type: BID-66969
Nagios Remote Plugin Executor 'nrpe.c' Remote Code Execution Vulnerability

Source: XF
Type: UNKNOWN
nagios-nrpe-code-exec(92691)

Source: CCN
Type: Packet Storm Security [04-17-2014]
Nagios Remote Plugin Executor 2.15 Remote Command Execution

Source: CCN
Type: Packet Storm Security [08-28-2014]
NRPE 2.15 Remote Command Execution

Source: EXPLOIT-DB
Type: EXPLOIT
Offensive Security Exploit Database [08-29-2014]

Vulnerable Configuration:Configuration 1:
  • cpe:/a:nagios:remote_plugin_executor:*:*:*:*:*:*:*:* (Version <= 2.15)
  • OR cpe:/o:opensuse:opensuse:11.4:*:*:*:*:*:*:*
  • OR cpe:/o:opensuse:opensuse:12.3:*:*:*:*:*:*:*
  • OR cpe:/o:opensuse:opensuse:13.1:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:nagios:remote_plugin_executor:2.15:*:*:*:*:*:*:*
  • AND
  • cpe:/a:ibm:powerkvm:2.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:powerkvm:3.1:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:20142913
    V
    		CVE-2014-2913
    2022-06-30
    oval:org.opensuse.security:def:112991
    P
    		monitoring-plugins-nrpe-4.0.3-3.5 on GA media (Moderate)
    2022-01-17
    oval:org.opensuse.security:def:34681
    P
    		Security update for the Linux Kernel (Important)
    2022-01-13
    oval:org.opensuse.security:def:26223
    P
    		Security update for net-snmp (Important)
    2022-01-05
    oval:org.opensuse.security:def:34612
    P
    		Security update for glib-networking (Important)
    2021-12-13
    oval:org.opensuse.security:def:31715
    P
    		Security update for the Linux Kernel (Important)
    2021-12-06
    oval:org.opensuse.security:def:31714
    P
    		Security update for webkit2gtk3 (Important)
    2021-12-01
    oval:org.opensuse.security:def:30272
    P
    		Security update for java-1_8_0-openjdk (Important)
    2021-11-23
    oval:org.opensuse.security:def:31308
    P
    		Security update for postgresql96 (Important)
    2021-11-22
    oval:org.opensuse.security:def:34573
    P
    		Security update for ncurses (Moderate)
    2021-10-20
    oval:org.opensuse.security:def:106438
    P
    		Security update for strongswan (Moderate)
    2021-10-19
    oval:org.opensuse.security:def:26139
    P
    		Security update for libvirt (Moderate)
    2021-10-04
    oval:org.opensuse.security:def:30129
    P
    		Security update for MozillaFirefox (Important)
    2021-09-22
    oval:org.opensuse.security:def:31270
    P
    		Security update for MozillaFirefox (Important)
    2021-09-22
    oval:org.opensuse.security:def:34524
    P
    		Security update for openexr (Important)
    2021-09-02
    oval:org.opensuse.security:def:26082
    P
    		Security update for openexr (Important)
    2021-06-24
    oval:org.opensuse.security:def:34466
    P
    		Security update for java-1_8_0-openjdk (Moderate)
    2021-06-15
    oval:org.opensuse.security:def:33929
    P
    		Security update for freeradius-server (Moderate)
    2021-06-11
    oval:org.opensuse.security:def:36248
    P
    		nagios-nrpe-2.12-24.4.10.1 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:42655
    P
    		nagios-nrpe-2.12-24.4.10.1 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:30186
    P
    		Security update for libnettle (Important)
    2021-04-28
    oval:org.opensuse.security:def:32081
    P
    		Security update for the Linux Kernel (Live Patch 32 for SLE 12 SP3) (Important)
    2021-04-28
    oval:org.opensuse.security:def:30041
    P
    		Security update for glib2 (Important)
    2021-03-16
    oval:org.opensuse.security:def:34637
    P
    		Security update for postgresql-jdbc (Moderate)
    2021-02-25
    oval:org.opensuse.security:def:31726
    P
    		Security update for the Linux Kernel (Important)
    2021-02-12
    oval:org.opensuse.security:def:32168
    P
    		Security update for openvswitch (Important)
    2021-02-02
    oval:org.opensuse.security:def:29836
    P
    		Security update for kdebase4-workspace (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:30530
    P
    		Security update for java-1_6_0-ibm (Important)
    2020-12-01
    oval:org.opensuse.security:def:32324
    P
    		Security update for samba (Important)
    2020-12-01
    oval:org.opensuse.security:def:34219
    P
    		Security update for php5 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:35319
    P
    		Security update for microcode_ctl (Important)
    2020-12-01
    oval:org.opensuse.security:def:26573
    P
    		kernel-default on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:29909
    P
    		Security update for libHX13
    2020-12-01
    oval:org.opensuse.security:def:30569
    P
    		Security update for libxml2
    2020-12-01
    oval:org.opensuse.security:def:32380
    P
    		Security update for tiff (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:34308
    P
    		Security update for quota
    2020-12-01
    oval:org.opensuse.security:def:35360
    P
    		Security update for nagios-nrpe, nagios-nrpe-debuginfo, nagios-nrpe-debugsource, nagios-nrpe-doc, nagios-plugins-nrpe
    2020-12-01
    oval:org.opensuse.security:def:27211
    P
    		libpython2_6-1_0 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:30588
    P
    		Security update for openssl (Important)
    2020-12-01
    oval:org.opensuse.security:def:32429
    P
    		Security update for xen (Important)
    2020-12-01
    oval:org.opensuse.security:def:33834
    P
    		Security update for gnutls (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27246
    P
    		nagios-nrpe on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:30632
    P
    		Security update for Xen
    2020-12-01
    oval:org.opensuse.security:def:31800
    P
    		Security update for SuSEfirewall2 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32468
    P
    		Security update for xorg-x11-libs (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:33835
    P
    		Security update for gpg2 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25797
    P
    		Security update for flash-player (Important)
    2020-12-01
    oval:org.opensuse.security:def:26374
    P
    		Security update for chromium (Important)
    2020-12-01
    oval:org.opensuse.security:def:31932
    P
    		Security update for libX11 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32490
    P
    		avahi on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:33846
    P
    		Security update for guile (Low)
    2020-12-01
    oval:org.opensuse.security:def:25798
    P
    		Security update for flash-player (Critical)
    2020-12-01
    oval:org.opensuse.security:def:26427
    P
    		Security update for python-Django (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32024
    P
    		Security update for the Linux Kernel (Important)
    2020-12-01
    oval:org.opensuse.security:def:32534
    P
    		kde4-kgreeter-plugins on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25809
    P
    		Security update for the Linux Kernel (Important)
    2020-12-01
    oval:org.opensuse.security:def:26476
    P
    		Security update for nextcloud (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:29824
    P
    		Security update for java-1_6_0-ibm (Important)
    2020-12-01
    oval:org.opensuse.security:def:30426
    P
    		Security update for xorg-x11-libs (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:33172
    P
    		libpng12-0 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:34065
    P
    		Security update for libxml2 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25873
    P
    		Security update for libcares2 (Low)
    2020-12-01
    oval:org.opensuse.security:def:26515
    P
    		MozillaFirefox on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:29825
    P
    		Security update for java-1_6_0-ibm (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:30481
    P
    		Security update for bsdtar (Important)
    2020-12-01
    oval:org.opensuse.security:def:33211
    P
    		nagios-nrpe on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:34162
    P
    		Security update for openssl (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26001
    P
    		Security update for openexr (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26529
    P
    		cifs-mount on GA media (Moderate)
    2020-12-01
    oval:org.mitre.oval:def:25346
    P
    		SUSE-SU-2014:0682-1 -- Security update for nagios-nrpe, nagios-nrpe-debuginfo, nagios-nrpe-debugsource, nagios-nrpe-doc, nagios-plugins-nrpe
    2014-09-08
    oval:com.ubuntu.artful:def:20142913000
    V
    		CVE-2014-2913 on Ubuntu 17.10 (artful) - low.
    2014-05-07
    oval:com.ubuntu.disco:def:201429130000000
    V
    		CVE-2014-2913 on Ubuntu 19.04 (disco) - low.
    2014-05-07
    oval:com.ubuntu.trusty:def:20142913000
    V
    		CVE-2014-2913 on Ubuntu 14.04 LTS (trusty) - low.
    2014-05-07
    oval:com.ubuntu.cosmic:def:201429130000000
    V
    		CVE-2014-2913 on Ubuntu 18.10 (cosmic) - low.
    2014-05-07
    oval:com.ubuntu.bionic:def:20142913000
    V
    		CVE-2014-2913 on Ubuntu 18.04 LTS (bionic) - low.
    2014-05-07
    oval:com.ubuntu.xenial:def:20142913000
    V
    		CVE-2014-2913 on Ubuntu 16.04 LTS (xenial) - low.
    2014-05-07
    oval:com.ubuntu.bionic:def:201429130000000
    V
    		CVE-2014-2913 on Ubuntu 18.04 LTS (bionic) - low.
    2014-05-07
    oval:com.ubuntu.cosmic:def:20142913000
    V
    		CVE-2014-2913 on Ubuntu 18.10 (cosmic) - low.
    2014-05-07
    oval:com.ubuntu.xenial:def:201429130000000
    V
    		CVE-2014-2913 on Ubuntu 16.04 LTS (xenial) - low.
    2014-05-07
    oval:com.ubuntu.precise:def:20142913000
    V
    		CVE-2014-2913 on Ubuntu 12.04 LTS (precise) - low.
    2014-05-07
    BACK
    nagios remote plugin executor *
    opensuse opensuse 11.4
    opensuse opensuse 12.3
    opensuse opensuse 13.1
    nagios remote plugin executor 2.15
    ibm powerkvm 2.1
    ibm powerkvm 3.1