OS Command Injection in Nagios-NRPE - CVE-2013-1362

Vulnerability identifier: #VU45691

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2013-1362

CWE-ID: CWE-78

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.

Nagios-NRPE
Amazon Linux AMI
Gentoo Linux
Arch Linux
Fedora
SUSE Linux
nrpe (Alpine package)
nrpe
net-analyzer/nrpe

Install updates from vendor's website.

nrpe (Alpine package) - update to 2.14-r0
nrpe - addressed in versions 2.14-3.el5, 2.14-3.el6
net-analyzer/nrpe - update to 2.15
nrpe - update to 3.2.1-3

• Exploit #4495 - Nagios Remote Plugin Executor - Arbitrary Command Execution (Metasploit) (August 14, 2020)
• Exploit #4494 - Nagios Remote Plugin Executor Arbitrary Command Execution (August 14, 2020)

• http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00005.html
• http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00006.html
• http://seclists.org/bugtraq/2013/Feb/119
• http://www.exploit-db.com/exploits/24955
• http://www.occamsec.com/vulnerabilities.html#nagios_metacharacter_vulnerability
• https://bugzilla.novell.com/show_bug.cgi?id=807241

• Remote code execution in Nagios Remote Plug-In Executor (NRPE)
• OS Command Injection in nrpe (Alpine package)
• SUSE Linux update for nagios-nrpe, nagios-plugins-nrpe
• Amazon Linux AMI update for nrpe
• Gentoo update for NRPE
• Arch Linux update for nrpe
• Fedora EPEL 6 update for nrpe
• Fedora EPEL 5 update for nrpe