The NET_TCP_LISTEN function in net.c in Zabbix Agent before 1.6.7, when running on FreeBSD or Solaris, allows remote attackers to bypass the EnableRemoteCommands setting and execute arbitrary commands via shell metacharacters in the argument to net.tcp.listen. NOTE: this attack is limited to attacks from trusted IP addresses.
References
| Link | Resource |
|---|---|
| http://secunia.com/advisories/37740 | Vendor Advisory |
| http://www.securityfocus.com/archive/1/508439 | |
| http://www.vupen.com/english/advisories/2009/3514 | Vendor Advisory |
| https://support.zabbix.com/browse/ZBX-1032 | Exploit |
| http://secunia.com/advisories/37740 | Vendor Advisory |
| http://www.securityfocus.com/archive/1/508439 | |
| http://www.vupen.com/english/advisories/2009/3514 | Vendor Advisory |
| https://support.zabbix.com/browse/ZBX-1032 | Exploit |
Configurations
Configuration 1 (hide)
| AND |
|
History
21 Nov 2024, 01:09
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://secunia.com/advisories/37740 - Vendor Advisory | |
| References | () http://www.securityfocus.com/archive/1/508439 - | |
| References | () http://www.vupen.com/english/advisories/2009/3514 - Vendor Advisory | |
| References | () https://support.zabbix.com/browse/ZBX-1032 - Exploit |
Information
Published : 2009-12-31 18:30
Updated : 2025-04-09 00:30
NVD link : CVE-2009-4502
Mitre link : CVE-2009-4502
CVE.ORG link : CVE-2009-4502
JSON object : View
Products Affected
zabbix
- zabbix
freebsd
- freebsd
sun
- solaris
CWE
CWE-264
Permissions, Privileges, and Access Controls