PT-2006-7293 · Zabbix · Zabbix

Max Vozeler + 1 · Published 2006-12-21 · Updated 2011-03-08 · CVE-2006-6692

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: zabbix versions prior to 20061006

Description: The issue concerns multiple format string vulnerabilities that could allow attackers to cause a denial of service, potentially leading to an application crash, and possibly execute arbitrary code. This is achieved through format string specifiers in information that would be recorded in the system log using functions such as zabbix log or zabbix syslog.

Recommendations: For versions prior to 20061006, update to a version released after 20061006 to resolve the issue. As a temporary workaround, consider restricting the use of zabbix log and zabbix syslog functions until a patch is available.

Exploit

Fix

Related Identifiers

CVE-2006-6692

Affected Products

Zabbix

References · 12

• 🔥 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=391388 · Exploit
• 🔥 https://exploit-db.com/exploits/28775 · Exploit
• 🔥 http://bugs.debian.org/cgi-bin/bugreport.cgi/zabbix.security.patch?bug=391388;msg=5;att=1 · Exploit
• https://security-tracker.debian.org/tracker/CVE-2006-6692 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2006-6692 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2006-6692 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-6692 · Security Note
• http://bugs.debian.org/cgi-bin/bugreport.cgi/zabbix.security.patch?bug=391388%3Bmsg=5%3Batt=1 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6692 · Note
• http://vupen.com/english/advisories/2006/3959 · Note
• http://securityfocus.com/bid/20416 · Note
• http://secunia.com/advisories/22313 · Note