PT-2023-7988 · Zabbix+2 · Zabbix+2

Vladislavs Sokurenko · Published 2023-03-10 · Updated 2024-12-10 · CVE-2023-29451

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Zabbix (affected versions not specified)

Description A specially crafted string can cause a buffer overrun in the JSON parser library, leading to a crash of the Zabbix Server or a Zabbix Proxy. This issue can be exploited by a remote attacker to cause a denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Memory Corruption

Weakness Enumeration

CWE-20

CWE-787

Related Identifiers

BDU:2023-09102

CVE-2023-29451

DLA-3538-1

DLA-3538-2

ROSA-SA-2024-2539

Affected Products

Astra Linux

Debian

Zabbix

References · 60

• 🔥 https://github.com/K3ysTr0K3R/CVE-2019-17382-EXPLOIT · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-29451 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-35230 · Security Note
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2024-1031SE47 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-09070 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-29451 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-01712 · Security Note
• https://osv.dev/vulnerability/CVE-2023-29451 · Vendor Advisory
• https://wiki.astralinux.ru/pages/viewpage.action?pageId=319139257 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-29449 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35229 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29457 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29456 · Security Note
• https://bdu.fstec.ru/vul/2023-09105 · Security Note
• https://bdu.fstec.ru/vul/2024-06939 · Security Note