openSUSE Security Update : nagios-nrpe (openSUSE-SU-2013:0621-1)
High Nessus Plugin ID 74957
SynopsisThe remote openSUSE host is missing a security update.
DescriptionNRPE (the Nagios Remote Plug-In Executor) allows the passing of $() to plugins/scripts which, if run under bash, will execute that shell command under a subprocess and pass the output as a parameter to the called script. Using this, it is possible to get called scripts, such as check_http, to execute arbitrary commands under the uid that NRPE/nagios is running as (typically, 'nagios').
With this update NRPE will deny remote requests containing a bash command substitution.
SolutionUpdate the affected nagios-nrpe packages.