Bug 571069

AFAICT this fix was back ported to the -el5 release as per the changelogs here

* Sun Sep 28 2008 Mike McGrath <mmcgrath> 1.4.13-4
- Upstream released new version #464419 
- Added patch fix for check_linux_raid #253898 
- Upstream releases fix for #451015 
- check_ntp_peers - Upstream released fix for #459309 
- check_ntp - Added Provides Nagios::Plugins for #457404 
- Fixed configure line for #458985 check_procs 

As per this bug report https://bugzilla.redhat.com/show_bug.cgi?id=451015

*** Bug 571372 has been marked as a duplicate of this bug. ***

First, sorry about the duplicate bug report.

This seems to be fixed in 1.4.13-15.el5 but it was nor released nor built, and anyway the cvs is in an inconsistent state :

[xavierb@bilbon EL-5]$ make srpm
rpmbuild --define "_sourcedir /home/xavierb/fedora/nagios-plugins/EL-5" --define "_specdir /home/xavierb/fedora/nagios-plugins/EL-5" --define "_builddir /home/xavierb/fedora/nagios-plugins/EL-5" --define "_srcrpmdir /home/xavierb/fedora/nagios-plugins/EL-5" --define "_rpmdir /home/xavierb/fedora/nagios-plugins/EL-5" --define "dist .el5" --define "rhel 5" --define "el5 1" --define "_source_filedigest_algorithm 1" --define "_binary_filedigest_algorithm 1" --nodeps -bs nagios-plugins.spec
error: Bad source: /home/xavierb/fedora/nagios-plugins/EL-5/nagios-plugins-1.4.13-ntp.patch: No such file or directory

The patch for this bug is missing from the EL-5 branch.

*** Bug 571870 has been marked as a duplicate of this bug. ***

Peter,

I have to agree with Xavier.  According to the actual nagios-plugin ChangeLogs (not the RPM ones, but from the tarball), this is the entry where the buffer overflow was fixed:

2008-11-19  Thomas Guyot-Sionnest <dermoth.net>

        * NEWS, plugins/check_ntp.c, plugins/check_ntp_peer.c: Fixed buffer
        overflow in check_ntp/check_ntp_peer (#1999319, Ubuntu #291265) git-svn-id:

        https://nagiosplug.svn.sourceforge.net/svnroot/nagiosplug/nagiosplug/trunk@2086 f882894a-f735-0410-b71e-b25c42
3dba1c

The most recent ChangeLog in from the nagios-plugins-1.4.13 SRPM is:

2008-09-25 08:04  tonvoon

        * [r2056] plugins/tests/check_http.t:
          Fix small test failure

Almost two months earlier.  Also, there doesn't seem to be any patch added to the build that addresses anything with the check_ntp_* plugins.

What is the chance that we could either get a rebuild with the relevent check_ntp_* buffer overflow patch applied or (preferred) a rebuild against the 1.4.14 source?

> What is the chance that we could either get a rebuild with the relevent
> check_ntp_* buffer overflow patch applied or (preferred) a rebuild against the
> 1.4.14 source?    

Every chance, I've only just taken over co-maintainer ship of the plugins so are basing my information from logs. Looking at the change log here (details quoted above)

http://koji.fedoraproject.org/koji/buildinfo?buildID=109396

and the original mention above here

http://sourceforge.net/tracker/?func=detail&atid=397597&aid=1999319&group_id=29880

which from the horrible change log and no reference to source repo logs I AFAICT had the fix in September (as mentioned in your post quoting change log Sept 25th) it looked to me like we pulled in the fix 3 days later. I will endeavour to investigate further tomorrow and compare the patch with the one in the above fore mentioned or cvs.

I'll update nagios-plugins to 1.4.14 very soon.

nagios-plugins-1.4.14-1.el5 has been submitted as an update for Fedora EPEL 5.
http://admin.fedoraproject.org/updates/nagios-plugins-1.4.14-1.el5

Folks, I just updated nagios-plugins for EL-5 up to ver. 1.4.14 - please test and provide feedback.

Fortunately, fedora branches already contains fix for this particular issue, so I'll update nagios-plugins here a little later (there are FTBFS issues in F-12 and F-13, which should be fixed first).

nagios-plugins-1.4.14-1.el5 has been pushed to the Fedora EPEL 5 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update nagios-plugins'.  You can provide feedback for this update here: http://admin.fedoraproject.org/updates/nagios-plugins-1.4.14-1.el5

Installed the new RPMs and check_ntp_peer i now working fine:

[root@centos-5-amd64 tom]# /usr/lib64/nagios/plugins/check_ntp_peer -H time.straycat.dhs.org
NTP OK: Offset -0.000124 secs|offset=-0.000124s;60.000000;120.000000;


I looked at the changelog for 1.4.14 and I'll just note this line from it:

* Extra-opts (C plugins) does not allow trailing comments anymore (like N::P)

There were a bunch of fixes for --extra-opts in this release.  Among the changes is it looks like C plugins can no longer have trailing comments in .ini files which matches the behavior of the perl based plugins.  I know EPEL's requirements wrt config file changes is stricter than Fedora's so I'm pointing this out.  On the plus side, after an update an affected user will get a notification when their checks fail.

The new RPMs also fix check_ntp_peer for us and otherwise seem to be working fine.

+1 for promotion from testing to stable (unless there are other pending concerns).

nagios-plugins-1.4.14-1.el5 has been pushed to the Fedora EPEL 5 stable repository.  If problems still persist, please make note of it in this bug report.