Lucene search

MitreCVE-2009-4502

HistoryDec 31, 2009 - 6:30 p.m.

CVE-2009-4502

2009-12-3118:30:01

CWE-264

mitre

web.nvd.nist.gov

zabbix

agent

net_tcp_listen

vulnerability

cve-2009-4502

nvd

security

bypass

shell metacharacters

freebsd

solaris

CVSS2

9.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

AI Score

7.6

Confidence

Low

EPSS

0.652

Percentile

97.9%

JSON

The NET_TCP_LISTEN function in net.c in Zabbix Agent before 1.6.7, when running on FreeBSD or Solaris, allows remote attackers to bypass the EnableRemoteCommands setting and execute arbitrary commands via shell metacharacters in the argument to net.tcp.listen. NOTE: this attack is limited to attacks from trusted IP addresses.

Affected configurations

Nvd

Node

zabbixzabbixRange≤1.6.6

zabbixzabbixMatch1.1.2

zabbixzabbixMatch1.1.3

zabbixzabbixMatch1.1.4

zabbixzabbixMatch1.1.5

zabbixzabbixMatch1.4.2

zabbixzabbixMatch1.4.3

zabbixzabbixMatch1.4.4

zabbixzabbixMatch1.4.6

AND

freebsdfreebsd

sunsolaris

VendorProductVersionCPE
zabbixzabbix*cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:*
zabbixzabbix1.1.2cpe:2.3:a:zabbix:zabbix:1.1.2:*:*:*:*:*:*:*
zabbixzabbix1.1.3cpe:2.3:a:zabbix:zabbix:1.1.3:*:*:*:*:*:*:*
zabbixzabbix1.1.4cpe:2.3:a:zabbix:zabbix:1.1.4:*:*:*:*:*:*:*
zabbixzabbix1.1.5cpe:2.3:a:zabbix:zabbix:1.1.5:*:*:*:*:*:*:*
zabbixzabbix1.4.2cpe:2.3:a:zabbix:zabbix:1.4.2:*:*:*:*:*:*:*
zabbixzabbix1.4.3cpe:2.3:a:zabbix:zabbix:1.4.3:*:*:*:*:*:*:*
zabbixzabbix1.4.4cpe:2.3:a:zabbix:zabbix:1.4.4:*:*:*:*:*:*:*
zabbixzabbix1.4.6cpe:2.3:a:zabbix:zabbix:1.4.6:*:*:*:*:*:*:*
freebsdfreebsd*cpe:2.3:o:freebsd:freebsd:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
zabbix	zabbix	*	cpe:2.3:a:zabbix:zabbix::::::::
zabbix	zabbix	1.1.2	cpe:2.3:a:zabbix:zabbix:1.1.2:::::::*
zabbix	zabbix	1.1.3	cpe:2.3:a:zabbix:zabbix:1.1.3:::::::*
zabbix	zabbix	1.1.4	cpe:2.3:a:zabbix:zabbix:1.1.4:::::::*
zabbix	zabbix	1.1.5	cpe:2.3:a:zabbix:zabbix:1.1.5:::::::*
zabbix	zabbix	1.4.2	cpe:2.3:a:zabbix:zabbix:1.4.2:::::::*
zabbix	zabbix	1.4.3	cpe:2.3:a:zabbix:zabbix:1.4.3:::::::*
zabbix	zabbix	1.4.4	cpe:2.3:a:zabbix:zabbix:1.4.4:::::::*
zabbix	zabbix	1.4.6	cpe:2.3:a:zabbix:zabbix:1.4.6:::::::*
freebsd	freebsd	*	cpe:2.3:o:freebsd:freebsd::::::::