Bugzilla – Bug 1037820
[server:monitoring/zabbix]: CVE-2017-2824 zabbix: Multiple vulnerabilities
Last modified: 2017-05-05 21:36:29 UTC
rh#1448392 Two vulnerabilities in the Zabbix server were reported by the Cisco TALOS. It seems they were both assigned one CVE ID --> CVE-2017-2824 TALOS-2017-0325 Zabbix Server Active Proxy Trapper Remote Code Execution Vulnerability An exploitable code execution vulnerability exists in the trapper command functionality of Zabbix Server 2.4.X . A specially crafted set of packets can cause a command injection resulting in remote code execution. An attacker can make requests from an active Zabbix Proxy to trigger this vulnerability. http://www.talosintelligence.com/reports/TALOS-2017-0325/ TALOS-2017-0326 Zabbix Proxy Server SQL Database Write Vulnerability An exploitable database write vulnerability exists in the trapper functionality of Zabbix Server 2.4.X . Specifically crafted trapper packets can pass database logic checks, resulting in database writes. An attacker set up a Man-in-the-Middle server to alter trapper requests made between an active Zabbix proxy and Server to trigger this vulnerability. http://www.talosintelligence.com/reports/TALOS-2017-0326/ References: https://bugzilla.redhat.com/show_bug.cgi?id=1448392 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-2824 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2824
2.4.X package is dropped from project as it is officially EOL 3.0.9 is fixed packaged version (updated 14 days ago - 21.04.2017) 2.2.18 is fixed packaged version (updated 14 days ago - 21.04.2017) Confirmation of fixes in released packages can be found at https://support.zabbix.com/browse/ZBX-12076