Nagios Support Forum

Hi,
Following the info here: http://legalhackers.com/advisories/nagios-nrpe.txt
Is is still possible? If yes - is there a good way to protect from this vulnerability?

Yes technically this vulnerability is still possible to exploit. As the disclosure states for solutions, the easiest and clearest option to stop this, is to disable arguments from nrpe. We realize this isn't always an ideal option, so using ip restrictions such as nrpe's allowed hosts, iptables, and xinetd. Encrypting the connection is also of course suggested. We have been discussing changes to this behavior, but a proper fix and not simply a bandaid is really required, and going to need some time.

OK thanks

You're welcome, going to lock this up.