Zmanda Recovery Manager for MySQL socket-server.pl MYSQL_BINPATH Variable Command Execution

high Nessus Plugin ID 40886

Synopsis

The remote backup service allows execution of arbitrary code.

Description

The remote service appears to be Zmanda Recovery Manager (ZRM) for MySQL's socket-server.pl. ZRM for MySQL offers a backup and recovery solution for MySQL, and the socket-server.pl component typically runs on a MySQL server out of xinetd to support remote operations.

The installed version of socket-server.pl fails to sanitize user input to the 'MYSQL_BINPATH' variable before using it in a 'system()' call.
An unauthenticated, remote attacker can leverage this issue to execute arbitrary commands on the remote host subject to the privileges under which the service runs, typically 'mysql'.

Solution

Upgrade to Zmanda ZRM 2.1.1 or later.

See Also

http://www.intevydis.com/blog/?p=51

http://forums.zmanda.com/showthread.php?2144-PLEASE-READ-Please-upgrade-to-ZRM-community-release-2-1-1

Plugin Details

Severity: High

ID: 40886

File Name: zrm_mysql_binpath_cmd_exec.nasl

Version: 1.16

Type: remote

Family: CGI abuses

Published: 9/7/2009

Updated: 4/11/2022

Configuration: Enable thorough checks

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 7.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No exploit is required

Exploited by Nessus: true

Patch Publication Date: 8/25/2009

Vulnerability Publication Date: 8/25/2009

Reference Information

CVE: CVE-2009-3102

BID: 42417

CWE: 20

SECUNIA: 36424