Bug 1167659 (CVE-2020-6582) - VUL-0: CVE-2020-6582: nrpe: heap-based buffer overflow due to a wrong integer type conversion
Summary: VUL-0: CVE-2020-6582: nrpe: heap-based buffer overflow due to a wrong integer...
Status: RESOLVED FIXED
Alias: CVE-2020-6582
Product: openSUSE Distribution
Classification: openSUSE
Component: Security (show other bugs)
Version: Leap 15.1
Hardware: Other Other
: P2 - High : Major (vote)
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/255201/
Whiteboard: CVSSv2:NVD:CVE-2020-6582:5.0:(AV:N/A...
Keywords:
Depends on:
Blocks:
 
Reported: 2020-03-25 13:44 UTC by Wolfgang Frisch
Modified: 2024-07-04 12:22 UTC (History)
1 user (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
nrpe-CVE-2020-6582-PoC.py (422 bytes, text/plain)
2020-03-26 14:27 UTC, Wolfgang Frisch 		Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Wolfgang Frisch 2020-03-25 13:44:37 UTC 
CVE-2020-6582

Nagios NRPE 3.2.1 has a Heap-Based Buffer Overflow, as demonstrated by interpretation of a small negative number as a large positive number during a bzero call.

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1816813
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-6582
http://people.canonical.com/~ubuntu-security/cve/2020/CVE-2020-6582.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6582
https://herolab.usd.de/security-advisories/usd-2020-0001/
Comment 1 Wolfgang Frisch 2020-03-26 14:27:34 UTC 
Created attachment 833948 [details]
nrpe-CVE-2020-6582-PoC.py

Steps to reproduce:

nrpe -n -c /etc/nrpe.cfg -4 -d
./nrpe-CVE-2020-6582-PoC.py

The syslog should not show a segmentation fault in nrpe.
Comment 2 Wolfgang Frisch 2020-03-26 14:28:05 UTC 
SUSE:SLE-11-SP1:Update   nagios-nrpe   Not affected [1]
SUSE:SLE-12:Update       nrpe          Not affected [1]

[1] The affected code (v3 packet support) does not exist yet.
Comment 3 Wolfgang Frisch 2020-03-26 14:42:58 UTC 
openSUSE:Factory         nrpe          Affected [1]
openSUSE:Leap:15.1       nrpe          Affected [1]

[1] Reproducible:
>nrpe[3592]: segfault at 55565acd5000 ip 00007f7301e2b67d sp 00007fff40f3a7b8 error 6 in libc-2.31.so[7f7301cec000+14c000]
Comment 4 Wolfgang Frisch 2024-07-04 12:22:33 UTC 
Fixed in
openSUSE:Factory/nrpe
openSUSE:Backports:SLE-15-SP5:Update/nrpe
openSUSE:Backports:SLE-15-SP6:Update/nrpe