Gentoo Linux Security Advisory 201408-18 - Multiple vulnerabilities have been found in NRPE, the worst of which can allow execution of arbitrary code. Versions less than 2.15 are affected.
8feca3ff4326a9ccd5256ab771b701482e417dac6ed79c6214bd0541bdfa1b2e
Mandriva Linux Security Advisory 2014-003 - Incomplete blacklist vulnerability in nrpc.c in Nagios Remote Plug-In Executor before 2.14 might allow remote attackers to execute arbitrary shell commands via $() shell metacharacters, which are processed by bash. The updated packages have been patched to correct this issue.
ae3af96c61f5cb0bcc8ef2cfd7bd0d9f0aa1fdf1facbc9382e974b70630cdf6e
The Nagios Remote Plugin Executor (NRPE) is installed to allow a central Nagios server to actively poll information from the hosts it monitors. NRPE has a configuration option dont_blame_nrpe which enables command-line arguments to be provided remote plugins. When this option is enabled, even when NRPE makes an effort to sanitize arguments to prevent command execution, it is possible to execute arbitrary commands.
f33086fbee9f7124aeac1e79a41679cd8f0bbbf1e8197cf0cad44c79bd7aa876
Nagios NRPE versions 2.13 and below suffer from a remote command execution vulnerability.
e554055ae18cd9fe6bcd14421d423114eca4f1e47b88e319df4e7a81bb4acf86