Sicherheitslücken in zabbix · Seite 5

Remove possibility to add html into Geomap attribution field

Currently, geomap configuration (Administration -> General -> Geographical maps) allows using HTML in the field “Attribution text” when selected “Other” Tile provider.

• Auf 6.0.18rc1 aktualisieren
• Auf 6.4.2rc1 aktualisieren

Denial of service caused by a bug in the JSON parser

Specially crafted string can cause a buffer overrun in the JSON parser library leading to a crash of the Zabbix Server or a Zabbix Proxy.

• Auf 6.0.15rc1 aktualisieren
• Auf 6.2.9rc2 aktualisieren
• Auf 6.4.1rc2 aktualisieren

Unauthorized limited filesystem access from preprocessing

JavaScript pre-processing can be used by the attacker to gain access to the file system (read-only access on behalf of user "zabbix") on the Zabbix Server or Zabbix Proxy, potentially leading to unauthorized access to sensitive data.

• Auf 5.0.32rc1 aktualisieren
• Auf 6.2.8rc1 aktualisieren

Limited control of resource utilization in JS preprocessing

JavaScript preprocessing, webhooks and global scripts can cause uncontrolled CPU, memory, and disk I/O utilization. Preprocessing/webhook/global script configuration and testing are only available to Administrative roles (Admin and Superadmin). Administrative privileges should be typically granted to users who need to perform tasks that require more control over the system. The security risk is limited because not all users have this level of access.

• Auf 5.0.32rc1 aktualisieren
• Auf 6.2.8rc1 aktualisieren
• Auf 6.4.0rc2 aktualisieren

CVE-2013-3628

Zabbix 2.0.9 has an Arbitrary Command Execution Vulnerability

CVE-2017-2824

An exploitable code execution vulnerability exists in the trapper command functionality of Zabbix Server 2.4.X. A specially crafted set of packets can cause a command injection resulting in remote code execution. An attacker can make requests from an active Zabbix Proxy to trigger this vulnerability.