BID:28968

ZoneMinder Multiple Unspecified Remote Code Execution Vulnerabilities

Info

ZoneMinder Multiple Unspecified Remote Code Execution Vulnerabilities

Bugtraq ID:	28968
Class:	Unknown
CVE:	CVE-2008-1381
Remote:	Yes
Local:	No
Published:	Apr 28 2008 12:00AM
Updated:	May 14 2008 02:25PM
Credit:	Mark J Cox
Vulnerable:	Triornis ZoneMinder 1.23.2 Triornis ZoneMinder 1.19.3 Triornis ZoneMinder 1.19.2 Triornis ZoneMinder 1.19.1 Triornis ZoneMinder 1.19 .0 Triornis ZoneMinder 1.18.1 Triornis ZoneMinder 1.18 .0 Triornis ZoneMinder 1.17.2 Triornis ZoneMinder 1.17.1 Triornis ZoneMinder 1.17 .0 Red Hat Fedora 9 Red Hat Fedora 8 Red Hat Fedora 7

Not Vulnerable:	Triornis ZoneMinder 1.23.3

Discussion

ZoneMinder Multiple Unspecified Remote Code Execution Vulnerabilities

ZoneMinder is prone to multiple unspecified remote code-execution vulnerabilities.

Successful exploits allow remote, authenticated attackers to execute arbitrary script code with the privileges of the webserver user. This may facilitate the remote compromise of the underlying operating system.

Versions prior to ZoneMinder 1.23.3 are vulnerable.

Exploit / POC

ZoneMinder Multiple Unspecified Remote Code Execution Vulnerabilities

Attackers can likely exploit these issues via a browser.

Solution / Fix

ZoneMinder Multiple Unspecified Remote Code Execution Vulnerabilities

Solution:
The vendor has released ZoneMinder 1.23.3 to address these issues. Please see the references for more information.

Triornis ZoneMinder 1.17 .0