PT-2013-6134 · Zabbix+1 · Zabbix+1

Publicado 2013-12-09 · Atualizado 2014-03-06 · CVE-2013-6824

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Zabbix versions prior to 1.8.19rc1 Zabbix versions prior to 2.0.10rc1 Zabbix versions prior to 2.2.1rc1

Description The issue allows remote Zabbix servers and proxies to execute arbitrary commands via a newline in a flexible user parameter. This can be exploited by sending a malicious request to the affected Zabbix server or proxy.

Recommendations For versions prior to 1.8.19rc1, update to version 1.8.19rc1 or later. For versions prior to 2.0.10rc1, update to version 2.0.10rc1 or later. For versions prior to 2.2.1rc1, update to version 2.2.1rc1 or later.

Exploit

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

ALT-PU-2013-1261

CVE-2013-6824

MGASA-2014-0015

Produtos afetados

Alt Linux

Zabbix

Referências · 24

• 🔥 https://support.zabbix.com/browse/ZBX-7479 · Exploit
• https://errata.altlinux.org/ALT-PU-2013-1261 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6824 · Nota de Segurança
• https://cve.org/CVERecord?id=CVE-2013-6824 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-6824 · Aviso do Fabricante
• https://support.zabbix.com/browse/ZBX-7091 · Nota
• http://zabbix.com/rn2.0.10rc1.php · Aviso do Fabricante
• https://bugs.mageia.org/show_bug.cgi?id=11868 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6824 · Nota
• https://ubuntu.com/security/CVE-2013-6824 · Aviso do Fabricante
• http://zabbix.com/rn1.8.19rc1.php · Aviso do Fabricante
• https://advisories.mageia.org/MGASA-2014-0015.html · Nota de Segurança
• http://zabbix.com/rn2.0.10.php · Nota
• https://lists.fedoraproject.org/pipermail/package-announce/2013-December/123446.html · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2013-6824 · Aviso do Fabricante