Bugzilla – Bug 1167658
VUL-0: CVE-2020-6581: nrpe: insufficient filtering and incorrect parsing of the configuration file may lead to command injection
Last modified: 2024-07-04 07:25:30 UTC
CVE-2020-6581 Nagios NRPE 3.2.1 has Insufficient Filtering because, for example, nasty_metachars interprets \n as the character \ and the character n (not as the \n newline sequence). This can cause command injection. References: https://bugzilla.redhat.com/show_bug.cgi?id=1816801 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-6581 http://people.canonical.com/~ubuntu-security/cve/2020/CVE-2020-6581.html http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6581 https://herolab.usd.de/security-advisories/ https://herolab.usd.de/security-advisories/usd-2020-0002/
SUSE:SLE-11-SP1:Update nagios-nrpe Not affected [1] SUSE:SLE-12:Update nrpe Not affected [1] openSUSE:Factory nrpe Affected [2] openSUSE:Leap:15.1 nrpe Affected [2] [1] These versions do not support the `nasty_metachars` option in the configuration file. [2] This version of nrpe parses the `nasty_metachars` option in the configuration file incorrectly. When `nasty_metachars` is set in /etc/nrpe.cfg, the daemon rejects arguments that contain the character "n": /usr/lib/nagios/plugins/check_nrpe -n -H 127.0.0.1 -c check_POC -a "n" >nrpe[10076]: Error: Request contained illegal metachars! I was not able to reproduce the exploit but the bug exists nevertheless. Please submit for openSUSE.
Resolved