monitoring-plugins/monitoring-plugins v3.0.3

3.0.3 Gabriele Tergit

on GitHub

This release contains a fix for a security vulnerability regarding check_mailq.
Technically we do not introduce the security problem, but strongly lead people
to create one.

check_mailq could be used with the sudo option (-s/--sudo) and would execute
sudo then with mailq as an argument AND additional arbitrary arguments given by the user.
A simple sudo rule to allow the monitoring user to execute this, could lead to arbitrary
command execution with root privileges.

The patch with this release disables the whole sudo option of check_mailq.
Allowing the monitoring user to view the mail queue is now a problem of the MTA and
most (hopefully all) MTAs should support this in one way or another.

We thank @c-kr (again) for reporting the problem.

Other changes

• check_smtp:
  • Trying to use authentication resulted in an UNKNOWN state
    if the authentication succeeded. It returns OK again now.
  • The port logic in SMTP was a bit broken. When the order
    of cli parameters was wrong, the wrong port was used for
    either direct TLS or STARTTLS when using the certificate
    lifetime option (-D). The default port is now directly
    taken from --ssl/--starttls and one of these has to be
    selected explicitly.
• check_swap
  • On FreeBSD information about swap usage was not detected
    correctly (it was assumed that swap was disabled).
    It should work now as expected again.
• check_snmp:
  • On Gentoo builds would fail to due a certain net-snmp
    configuration. This should be fixed and check_snmp
    offers the options which net-snmp on that system has
  • SNMPv3 authentication and privacy was broken since 3.0.0
    This should be fixed now.
• check_ups
  • Since 3.0.0 there were some new bugs which reduced the utility
    significantly. Those were fixed.

The codename for this release is "Gabriele Tergit".