PT-2023-9377 · Zabbix+4 · Zabbix+4

Maris Melnikovs + 1 · Publicado 2023-06-16 · Atualizado 2024-10-03 · CVE-2023-29458

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Zabbix versions (affected versions not specified) Duktape version 2.6

Description The issue is related to an unverified array indexing in the Duktape component of the Zabbix monitoring system. This can lead to a denial of service when exploited by a remote attacker. The problem occurs due to a bug in Duktape 2.6, which is a third-party embeddable JavaScript engine used for its portability and compact footprint. When too many values are added to the valstack in JavaScript, it will crash.

Recommendations For Duktape version 2.6, consider disabling the use of the valstack in JavaScript until a patch is available. As a temporary workaround, restrict the number of values that can be added to the valstack to prevent JavaScript from crashing. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Validation of Array Index

Enumeração de Fraquezas

CWE-129

Identificadores relacionados

ALT-PU-2023-5065

ALT-PU-2023-6268

BDU:2024-06937

CVE-2023-29458

DLA-3909-1

Produtos afetados

Alt Linux

Astra Linux

Debian

Duktape

Zabbix

Referências · 93

• https://github.com/paalbra/zabbix-zbxsec-7 · Nota
• https://bdu.fstec.ru/vul/2023-01720 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-22119 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-29458 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23133 · Nota de Segurança
• https://xn--80ahaefyxhn.xn--j1afgaq.xn--p1ai/bin/view/%D0%9E%D0%A1%D0%BD%D0%BE%D0%B2%D0%B0/%D0%9E%D0%B1%D0%BD%D0%BE%D0%B2%D0%BB%D0%B5%D0%BD%D0%B8%D1%8F/2.11 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35230 · Nota de Segurança
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2024-1031SE47 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2024-00033 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2023-29458 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24917 · Nota de Segurança
• https://altsp.su/obnovleniya-bezopasnosti · Nota
• https://bdu.fstec.ru/vul/2023-01712 · Nota de Segurança
• https://bdu.fstec.ru/vul/2024-04280 · Nota de Segurança
• https://wiki.astralinux.ru/pages/viewpage.action?pageId=319139257 · Aviso do Fabricante