Bug#701227: [Pkg-nagios-devel] Bug#701227: nagios-nrpe: CVE-2013-1362: allows the passing of $() as command arguments to execute shell commands

2013-03-04 Thread Alexander Wirt
Salvatore Bonaccorso schrieb am Sunday, den 03. March 2013: Control: tags -1 + patch Hi Alex On Sat, Feb 23, 2013 at 01:19:14PM +0100, Alexander Wirt wrote: On Sat, 23 Feb 2013, Salvatore Bonaccorso wrote: On Sat, Feb 23, 2013 at 08:33:20AM +0100, Salvatore Bonaccorso wrote: In

Bug#701227: [Pkg-nagios-devel] Bug#701227: nagios-nrpe: CVE-2013-1362: allows the passing of $() as command arguments to execute shell commands

2013-03-04 Thread Salvatore Bonaccorso
Hey Alex On Mon, Mar 04, 2013 at 09:06:52AM +0100, Alexander Wirt wrote: [...] In fact it looks like the patch on my disk :). I am sorry for not handling this earlier, but our new bathroom took my whole spare time in the last weeks. It should be better this week. Okay and thank you!

Bug#701227: [Pkg-nagios-devel] Bug#701227: nagios-nrpe: CVE-2013-1362: allows the passing of $() as command arguments to execute shell commands

2013-03-03 Thread Salvatore Bonaccorso
Control: tags -1 + patch Hi Alex On Sat, Feb 23, 2013 at 01:19:14PM +0100, Alexander Wirt wrote: On Sat, 23 Feb 2013, Salvatore Bonaccorso wrote: On Sat, Feb 23, 2013 at 08:33:20AM +0100, Salvatore Bonaccorso wrote: In the debian package we have explicitly --enable-command-args so the

Processed: Re: Bug#701227: [Pkg-nagios-devel] Bug#701227: nagios-nrpe: CVE-2013-1362: allows the passing of $() as command arguments to execute shell commands

2013-03-03 Thread Debian Bug Tracking System
Processing control commands: tags -1 + patch Bug #701227 [nagios-nrpe] nagios-nrpe: CVE-2013-1362: allows the passing of $() as command arguments to execute shell commands Added tag(s) patch. -- 701227: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=701227 Debian Bug Tracking System Contact

Bug#701227: [Pkg-nagios-devel] Bug#701227: nagios-nrpe: CVE-2013-1362: allows the passing of $() as command arguments to execute shell commands

2013-02-23 Thread Alexander Wirt
On Sat, 23 Feb 2013, Salvatore Bonaccorso wrote: On Sat, Feb 23, 2013 at 08:33:20AM +0100, Salvatore Bonaccorso wrote: In the debian package we have explicitly --enable-command-args so the Debian packages looks affected. But needs to be explicitly enabled in /etc/nagios/nrpe.cfg, should