Zabbix 2.0.x < 2.0.21 / 2.2.x < 2.2.18 / 3.0.x < 3.0.9 / 3.2.x < 3.2.5 Multiple Vulnerabilities
high Nessus Plugin ID 100615
Language:
Synopsis
A web application running on the remote host is affected by multiple vulnerabilities.Description
According to its self-reported version number, the instance of Zabbix running on the remote host is 2.0.x prior to 2.0.21, 2.2.x prior to 2.2.18, 3.0.x prior to 3.0.9, or 3.2.x prior to 3.2.5. It is, therefore, affected by multiple vulnerabilities :- A remote code execution vulnerability exists in the trapper command functionality due to improper handling of trapper packets. An unauthenticated, remote attacker can exploit this, via a specially crafted set of trapper packets, to inject arbitrary commands and execute arbitrary code. (CVE-2017-2824 / TALOS-2017-0325)
- A security bypass vulnerability exists in the trapper command functionality due to improper handling of trapper packets. A man-in-the-middle (MitM) attacker can exploit this, via a specially crafted trapper packet, to bypass database security checks and write arbitrary data to the database. (CVE-2017-2825 / TALOS-2017-0326)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Upgrade to Zabbix version 2.0.21 / 2.2.18 / 3.0.9 / 3.2.5 or later.Alternatively, to mitigate CVE-2017-2824, delete the three default script entries inside the Zabbix Server database per the TALOS-2017-0325 advisory.
See Also
https://blog.talosintelligence.com/2017/04/zabbix-multiple-vulns.html
https://www.talosintelligence.com/reports/TALOS-2017-0325/
https://www.talosintelligence.com/reports/TALOS-2017-0326/
Plugin Details
Severity: High
ID: 100615
File Name: zabbix_frontend_3_2_5.nasl
Version: 1.5
Type: remote
Family: CGI abuses
Published: 6/5/2017
Updated: 4/11/2022
Configuration: Enable paranoid mode, Enable thorough checks
Risk Information
VPR
Risk Factor: Medium
Score: 6.7
CVSS v2
Risk Factor: Medium
Base Score: 6.8
Temporal Score: 5
Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Temporal Vector: E:U/RL:OF/RC:C
CVSS Score Source: CVE-2017-2825
CVSS v3
Risk Factor: High
Base Score: 7
Temporal Score: 6.1
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L
Temporal Vector: E:U/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:zabbix:zabbix
Required KB Items: installed_sw/zabbix, Settings/ParanoidReport
Exploit Ease: No exploit is required
Patch Publication Date: 4/27/2017
Vulnerability Publication Date: 4/27/2017
Reference Information
CVE: CVE-2017-2824, CVE-2017-2825