Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Nagios NRPE may crash or be taken over

CVE-2020-6582 · published 6 years ago
Summary

The NRPE component used in Debian and Alpine systems (version 3.2.1) can mishandle specially crafted input, causing a memory overflow. This could let an attacker cause the service to stop working or execute their own code. Update NRPE to a newer release or apply the vendor’s security patch as soon as possible.

What to do
  • Update debian nagios-nrpe to version 4.0.0-1.
  • Update alpine nrpe to version 4.0.0-r0.
Affected software
Ecosystem VendorProductAffected versions
Debian:12 debian nagios-nrpe < 4.0.0-1
Fix: upgrade to 4.0.0-1
Debian:13 debian nagios-nrpe < 4.0.0-1
Fix: upgrade to 4.0.0-1
Debian:14 debian nagios-nrpe < 4.0.0-1
Fix: upgrade to 4.0.0-1
Alpine:v3.13 alpine nrpe < 4.0.0-r0
Fix: upgrade to 4.0.0-r0
– nagios remote_plug_in_executor 3.2.1
cpe:2.3:a:nagios:remote_plug_in_executor:3.2.1:*:*:*:*:*:*:*
– fedoraproject fedora 32
cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*
Original advisory text
Nagios NRPE 3.2.1 has a Heap-Based Buffer Overflow, as demonstrated by interpretation of a small negative number as a large positive number during a bzero call.
Nagios NRPE 3.2.1 has a Heap-Based Buffer Overflow, as demonstrated by interpretation of a small negative number as a large positive number during a bzero call.
References
Severity
7.5 High
Exploitation
4% chance of attack within 30 days
Type
CWE-681Incorrect Conversion between Numeric Types
CWE-787Out-of-bounds Write
Timeline
Published16 Mar 2020
Updated24 Oct 2026
First seen11 Sep 2026
Sources
DEBIAN-CVE-2020-6582 · OSV
ALPINE-CVE-2020-6582 · OSV
CVE-2020-6582 · NVD
Track software like this
Free during beta