Hi,
Following the info here: http://legalhackers.com/advisories/nagios-nrpe.txt
Is is still possible? If yes - is there a good way to protect from this vulnerability?
NRPE service VULNERABILITY
-
sreinhardt
- -fno-stack-protector
- Posts: 4366
- Joined: Mon Nov 19, 2012 12:10 pm
Re: NRPE service VULNERABILITY
Yes technically this vulnerability is still possible to exploit. As the disclosure states for solutions, the easiest and clearest option to stop this, is to disable arguments from nrpe. We realize this isn't always an ideal option, so using ip restrictions such as nrpe's allowed hosts, iptables, and xinetd. Encrypting the connection is also of course suggested. We have been discussing changes to this behavior, but a proper fix and not simply a bandaid is really required, and going to need some time.
Nagios-Plugins maintainer exclusively, unless you have other C language bugs with open-source nagios projects, then I am happy to help! Please pm or use other communication to alert me to issues as I no longer track the forum.
-
sreinhardt
- -fno-stack-protector
- Posts: 4366
- Joined: Mon Nov 19, 2012 12:10 pm
Re: NRPE service VULNERABILITY
You're welcome, going to lock this up.
Nagios-Plugins maintainer exclusively, unless you have other C language bugs with open-source nagios projects, then I am happy to help! Please pm or use other communication to alert me to issues as I no longer track the forum.