Igor Danoshaites

**Name of the Vulnerable Software and Affected Versions** Zabbix Server versions prior to 1.8 **Description** The issue allows remote attackers to execute arbitrary commands via a crafted request. This is due to a problem in the node process command function. **Recommendations** For versions prior to 1.8, update to version 1.8 or later to resolve the issue. As a temporary workaround, consider restricting access to the node process command function until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Zabbix Server versions prior to 1.6.8 **Description** A SQL injection issue exists in the get history lastid function within the nodewatcher component, allowing remote attackers to execute arbitrary SQL commands via a crafted request. This issue may be related to the send history last id function in zabbix server/trapper/nodehistory.c. **Recommendations** For versions prior to 1.6.8, update to version 1.6.8 or later to resolve the issue. As a temporary workaround, consider restricting access to the nodewatcher component to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Zabbix Agent versions prior to 1.6.7 **Description** The issue allows remote attackers to bypass the EnableRemoteCommands setting and execute arbitrary commands via shell metacharacters in the argument to `net.tcp.listen`, but only from trusted IP addresses. **Recommendations** For versions prior to 1.6.7, update to version 1.6.7 or later to resolve the issue. As a temporary workaround, consider restricting access to trusted IP addresses to minimize the risk of exploitation.