zabbix_agentd 1.1.4 in ZABBIX before 1.4.3 runs "UserParameter" scripts with gid 0, which might allow local users to gain privileges.

- Sat Dec 1 2007 Dan Horak <dan[at]danny.cz> 1.4.2-4

    - add security fix (#407181)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Sat Dec 1 2007 Dan Horak <dan[at]danny.cz> 1.4.2-3

    - add security fix (#407181)

    - Thu Sep 20 2007 Dan Horak <dan[at]danny.cz> 1.4.2-2

    - Fix paths (%_bindir -> %_sbindir) in init scripts       (#297061)

    - Add a patch to clean a warning during compile

    - Add a patch to fix cpu load computations

    - Tue Sep 11 2007 Dan Horak <dan[at]danny.cz> 1.4.2-1

    - New upstream release

    - Mon Jul 2 2007 Jarod Wilson <jwilson at redhat.com>       1.4.1-1

    - New upstream release

    - Fri Jun 29 2007 Jarod Wilson <jwilson at redhat.com>       1.4-3

    - Install correct sql init files (#244991)

    - Add Requires: php-bcmath to zabbix-web (#245767)

    - Wed May 30 2007 Jarod Wilson <jwilson at redhat.com>       1.4-2

    - Add placeholder zabbix.conf.php

    - Tue May 29 2007 Jarod Wilson <jwilson at redhat.com>       1.4-1

    - New upstream release

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Bas van Schaik discovered that the agentd process of Zabbix, a network monitor system, may run user-supplied commands as group id root, not zabbix, which may lead to a privilege escalation.

zabbix is not included in the oldstable distribution (sarge).

ID	Name	Product	Family	Severity
29275	Fedora 8 : zabbix-1.4.2-4.fc8 (2007-4176)	Nessus	Fedora Local Security Checks	low
29272	Fedora 7 : zabbix-1.4.2-3.fc7 (2007-4160)	Nessus	Fedora Local Security Checks	low
29227	Debian DSA-1420-1 : zabbix - programming error	Nessus	Debian Local Security Checks	low

Detections

Analytics

CVE-2007-6210

high

Tenable Plugins

low

low

low