Re: CVE Request: Nagios Remote Plugin Executor <= 2.15 Remote Command Execution

[Eduardo Tongson <propolice () gmail com>]

On Tue, Apr 22, 2014 at 12:11 PM,  <cve-assign () mitre org> wrote:
> ...
> Use CVE-2014-2913.

Thanks.

> We have not seen additional comments about whether \r would prevent an
> alternate attack approach. If it does, a separate CVE ID would be
> assigned. We do not know of a version of Bash in which \r separates
> commands in the same way that \n does. For example:
>
>   % /bin/bash -c "`echo -e "echo a\x0aecho b"`" | cat -v
>   a
>   b
>   % /bin/bash -c "`echo -e "echo a\x0decho b"`" | cat -v
>   a^Mecho b

Agreed. It's pointless to add a bunch of characters to a blacklist if
they do not have any effect.