PT-2013-6134 · Zabbix+1 · Zabbix+1

Published 2013-12-09 · Updated 2014-03-06 · CVE-2013-6824

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Zabbix versions prior to 1.8.19rc1 Zabbix versions prior to 2.0.10rc1 Zabbix versions prior to 2.2.1rc1

Description The issue allows remote Zabbix servers and proxies to execute arbitrary commands via a newline in a flexible user parameter. This can be exploited by sending a malicious request to the affected Zabbix server or proxy.

Recommendations For versions prior to 1.8.19rc1, update to version 1.8.19rc1 or later. For versions prior to 2.0.10rc1, update to version 2.0.10rc1 or later. For versions prior to 2.2.1rc1, update to version 2.2.1rc1 or later.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

ALT-PU-2013-1261

CVE-2013-6824

MGASA-2014-0015

Affected Products

Alt Linux

Zabbix

References · 24

• 🔥 https://support.zabbix.com/browse/ZBX-7479 · Exploit
• https://errata.altlinux.org/ALT-PU-2013-1261 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6824 · Security Note
• https://cve.org/CVERecord?id=CVE-2013-6824 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-6824 · Vendor Advisory
• http://zabbix.com/rn2.0.10rc1.php · Vendor Advisory
• https://ubuntu.com/security/CVE-2013-6824 · Vendor Advisory
• http://zabbix.com/rn1.8.19rc1.php · Vendor Advisory
• https://advisories.mageia.org/MGASA-2014-0015.html · Security Note
• https://lists.fedoraproject.org/pipermail/package-announce/2013-December/123446.html · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2013-6824 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2013-6824 · Vendor Advisory
• http://zabbix.com/rn2.2.1rc1.php · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2014-0015 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2013-6824 · Vendor Advisory