| Zabbix "UserParameter" Privilege Escalation Weakness |
|
|
|
| Por Marcelo Almeida (Vympel) | |
| 03 de December de 2007 | |
|
A weakness has been reported in Zabbix, which can be exploited by
malicious users to perform certain actions with escalated privileges. The weakness is caused due to the "daemon_start()" function in src/libs/zbxnix/daemon.c not correctly dropping the privileges. This can be exploited to e.g. execute "UserParameter" scripts as group "root". This affects the agent for UNIX-like operating systems only. The weakness is reported in version 1.4.2. Other versions may also be affected. Solution: Reportedly, this will be fixed in version 1.4.3. Provided and/or discovered by: Bas van Schaik Original Advisory: http://www.zabbix.com/forum/showthread.php?t=8400 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=452682 |
| < Anterior | Próximo > |
|---|
