zabbix CVE-2013-6824

Vulnerability description
————————-

Zabbix agent is vulnerable to remote command execution from the Zabbix server in some cases.

Please use CVE-2013-6824 to refer to this vulnerability.

This vulnerability has been reported by Recurity Labs Team.

——-
Details
——-

If a flexible (accepting parameters) user parameter is configured in the agent, including a newline in the parameters will execute newline section as a separate command even if UnsafeUserParameters are disabled.
This type of attack is only possible from Zabbix server or Zabbix proxy systems that are explicitly allowed in the agent configuration. Only flexible user parameters are vulnerable, static ones are not.

For example, a user parameter as the following would accept some prameters:

UserParameter=vfs.dir.size[*],du -s -B 1 “${1:-/tmp}” | cut -f1

The following would result in the ‘id’ command being executed:

echo -e “vfs.dir.size[\nid\n]” | nc localhost 10050

patch:

原文链接:,转发请注明来源!

发表评论

要发表评论,您必须先登录

  • 2 Responses to “zabbix CVE-2013-6824”