Lucene search

K

Debian: Security Advisory (DLA-1708-1)

🗓️ 11 Mar 2019 00:00:00Reported by Copyright (C) 2019 Greenbone AGType 
openvas
 openvas
🔗 plugins.openvas.org👁 59 Views

The Debian 'zabbix' package(s) are missing an update announced via the DLA-1708-1 advisory. It is affected by CVE-2016-10742 and CVE-2017-2826, resulting in information disclosure and remote link redirection. Upgrading zabbix packages is recommended

Show more
Related
Refs
Code
ReporterTitlePublishedViews
Family
Tenable Nessus
Debian DLA-1708-1 : zabbix security update
12 Mar 201900:00
nessus
Tenable Nessus
Debian DLA-2461-1 : zabbix security update
23 Nov 202000:00
nessus
Tenable Nessus
Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM : Zabbix vulnerabilities (USN-4767-1)
21 Oct 202300:00
nessus
Debian
[SECURITY] [DLA 1708-1] zabbix security update
11 Mar 201921:38
debian
Debian
[SECURITY] [DLA 2461-1] zabbix security update
21 Nov 202017:32
debian
CVE
CVE-2016-10742
17 Feb 201916:29
cve
CVE
CVE-2017-2826
9 Apr 201820:29
cve
Debian CVE
CVE-2016-10742
17 Feb 201916:29
debiancve
Debian CVE
CVE-2017-2826
9 Apr 201820:29
debiancve
Cvelist
CVE-2016-10742
17 Feb 201916:00
cvelist
Rows per page
# SPDX-FileCopyrightText: 2019 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

if(description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.891708");
  script_cve_id("CVE-2016-10742");
  script_tag(name:"creation_date", value:"2019-03-11 23:00:00 +0000 (Mon, 11 Mar 2019)");
  script_version("2024-02-02T05:06:07+0000");
  script_tag(name:"last_modification", value:"2024-02-02 05:06:07 +0000 (Fri, 02 Feb 2024)");
  script_tag(name:"cvss_base", value:"5.8");
  script_tag(name:"cvss_base_vector", value:"AV:N/AC:M/Au:N/C:P/I:P/A:N");
  script_tag(name:"severity_vector", value:"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N");
  script_tag(name:"severity_origin", value:"NVD");
  script_tag(name:"severity_date", value:"2019-02-22 17:36:28 +0000 (Fri, 22 Feb 2019)");

  script_name("Debian: Security Advisory (DLA-1708-1)");
  script_category(ACT_GATHER_INFO);
  script_copyright("Copyright (C) 2019 Greenbone AG");
  script_family("Debian Local Security Checks");
  script_dependencies("gather-package-list.nasl");
  script_mandatory_keys("ssh/login/debian_linux", "ssh/login/packages", re:"ssh/login/release=DEB8");

  script_xref(name:"Advisory-ID", value:"DLA-1708-1");
  script_xref(name:"URL", value:"https://www.debian.org/lts/security/2019/DLA-1708-1");
  script_xref(name:"URL", value:"https://wiki.debian.org/LTS");

  script_tag(name:"summary", value:"The remote host is missing an update for the Debian 'zabbix' package(s) announced via the DLA-1708-1 advisory.");

  script_tag(name:"vuldetect", value:"Checks if a vulnerable package version is present on the target host.");

  script_tag(name:"insight", value:"Several security vulnerabilities were discovered in Zabbix, a server/client network monitoring solution.

CVE-2016-10742

Zabbix allowed remote attackers to redirect to external links by misusing the request parameter.

CVE-2017-2826

An information disclosure vulnerability exists in the iConfig proxy request of Zabbix server. A specially crafted iConfig proxy request can cause the Zabbix server to send the configuration information of any Zabbix proxy, resulting in information disclosure. An attacker can make requests from an active Zabbix proxy to trigger this vulnerability.

This update also includes several other bug fixes and improvements. For more information please refer to the upstream changelog file.

For Debian 8 Jessie, these problems have been fixed in version 1:2.2.23+dfsg-0+deb8u1.

We recommend that you upgrade your zabbix packages.

Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: [link moved to references]");

  script_tag(name:"affected", value:"'zabbix' package(s) on Debian 8.");

  script_tag(name:"solution", value:"Please install the updated package(s).");

  script_tag(name:"solution_type", value:"VendorFix");
  script_tag(name:"qod_type", value:"package");

  exit(0);
}

include("revisions-lib.inc");
include("pkg-lib-deb.inc");

release = dpkg_get_ssh_release();
if(!release)
  exit(0);

res = "";
report = "";

if(release == "DEB8") {

  if(!isnull(res = isdpkgvuln(pkg:"zabbix-agent", ver:"1:2.2.23+dfsg-0+deb8u1", rls:"DEB8"))) {
    report += res;
  }

  if(!isnull(res = isdpkgvuln(pkg:"zabbix-frontend-php", ver:"1:2.2.23+dfsg-0+deb8u1", rls:"DEB8"))) {
    report += res;
  }

  if(!isnull(res = isdpkgvuln(pkg:"zabbix-java-gateway", ver:"1:2.2.23+dfsg-0+deb8u1", rls:"DEB8"))) {
    report += res;
  }

  if(!isnull(res = isdpkgvuln(pkg:"zabbix-proxy-mysql", ver:"1:2.2.23+dfsg-0+deb8u1", rls:"DEB8"))) {
    report += res;
  }

  if(!isnull(res = isdpkgvuln(pkg:"zabbix-proxy-pgsql", ver:"1:2.2.23+dfsg-0+deb8u1", rls:"DEB8"))) {
    report += res;
  }

  if(!isnull(res = isdpkgvuln(pkg:"zabbix-proxy-sqlite3", ver:"1:2.2.23+dfsg-0+deb8u1", rls:"DEB8"))) {
    report += res;
  }

  if(!isnull(res = isdpkgvuln(pkg:"zabbix-server-mysql", ver:"1:2.2.23+dfsg-0+deb8u1", rls:"DEB8"))) {
    report += res;
  }

  if(!isnull(res = isdpkgvuln(pkg:"zabbix-server-pgsql", ver:"1:2.2.23+dfsg-0+deb8u1", rls:"DEB8"))) {
    report += res;
  }

  if(report != "") {
    security_message(data:report);
  } else if(__pkg_match) {
    exit(99);
  }
  exit(0);
}

exit(0);

Transform Your Security Services

Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.

Book a live demo
11 Mar 2019 00:00Current
5.5Medium risk
Vulners AI Score5.5
CVSS25.8
CVSS36.1
EPSS0.002
59
.json
Report