Information disclosure and authentication bypass vulnerability exists in the Apache HTTP Server configuration bundled with ZoneMinder v1.30 and v1.29, which allows a remote unauthenticated attacker to browse all directories in the web root, e.g., a remote unauthenticated attacker can view all CCTV images on the server via the /events URI.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Information disclosure and authentication bypass vulnerability exists in the Apache HTTP Server     configuration bundled with ZoneMinder v1.30 and v1.29, which allows a remote unauthenticated attacker to     browse all directories in the web root, e.g., a remote unauthenticated attacker can view all CCTV images     on the server via the /events URI. (CVE-2016-10140)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Information disclosure and authentication bypass vulnerability exists in the Apache HTTP Server
    configuration bundled with ZoneMinder v1.30 and v1.29, which allows a remote unauthenticated attacker to
    browse all directories in the web root, e.g., a remote unauthenticated attacker can view all CCTV images
    on the server via the /events URI. (CVE-2016-10140)

  - A file disclosure and inclusion vulnerability exists in web/views/file.php in ZoneMinder 1.x through
    v1.30.0 because of unfiltered user-input being passed to readfile(), which allows an authenticated
    attacker to read local system files (e.g., /etc/passwd) in the context of the web server user (www-data).
    The attack vector is a .. (dot dot) in the path parameter within a zm/index.php?view=file&path= request.
    (CVE-2017-5595)

Information disclosure and authentication bypass vulnerability exists in the Apache HTTP Server configuration bundled with ZoneMinder v1.30.0, which allows a remote unauthenticated attacker to browse all directories in the web root, e.g., a remote unauthenticated attacker can view all CCTV images on the server.

For new installations, the new config file will be automatically installed. For existing installations, please follow the instructions in NEWS, which will be viewed during upgrade.

For Debian 7 'Wheezy', these problems have been fixed in version 1.25.0-4+deb7u1.

We recommend that you upgrade your zoneminder packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
254109	Linux Distros Unpatched Vulnerability : CVE-2016-10140	Nessus	Misc.	high
427695	Alpine: multiple zoneminder packages: security update to 1.30.2-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
427695	Alpine: multiple zoneminder packages: security update to 1.30.2-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
96841	Debian DLA-806-1 : zoneminder security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2016-10140

high

Tenable Plugins

high

high

high

high