The Debian 'zabbix' package(s) are missing an update announced via the DLA-1708-1 advisory. It is affected by CVE-2016-10742 and CVE-2017-2826, resulting in information disclosure and remote link redirection. Upgrading zabbix packages is recommended
Reporter | Title | Published | Views | Family All 25 |
---|---|---|---|---|
![]() | Debian DLA-1708-1 : zabbix security update | 12 Mar 201900:00 | – | nessus |
![]() | Debian DLA-2461-1 : zabbix security update | 23 Nov 202000:00 | – | nessus |
![]() | Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM : Zabbix vulnerabilities (USN-4767-1) | 21 Oct 202300:00 | – | nessus |
![]() | [SECURITY] [DLA 1708-1] zabbix security update | 11 Mar 201921:38 | – | debian |
![]() | [SECURITY] [DLA 2461-1] zabbix security update | 21 Nov 202017:32 | – | debian |
![]() | CVE-2016-10742 | 17 Feb 201916:29 | – | cve |
![]() | CVE-2017-2826 | 9 Apr 201820:29 | – | cve |
![]() | CVE-2016-10742 | 17 Feb 201916:29 | – | debiancve |
![]() | CVE-2017-2826 | 9 Apr 201820:29 | – | debiancve |
![]() | CVE-2016-10742 | 17 Feb 201916:00 | – | cvelist |
Source | Link |
---|---|
debian | www.debian.org/lts/security/2019/DLA-1708-1 |
wiki | www.wiki.debian.org/LTS |
# SPDX-FileCopyrightText: 2019 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only
if(description)
{
script_oid("1.3.6.1.4.1.25623.1.0.891708");
script_cve_id("CVE-2016-10742");
script_tag(name:"creation_date", value:"2019-03-11 23:00:00 +0000 (Mon, 11 Mar 2019)");
script_version("2024-02-02T05:06:07+0000");
script_tag(name:"last_modification", value:"2024-02-02 05:06:07 +0000 (Fri, 02 Feb 2024)");
script_tag(name:"cvss_base", value:"5.8");
script_tag(name:"cvss_base_vector", value:"AV:N/AC:M/Au:N/C:P/I:P/A:N");
script_tag(name:"severity_vector", value:"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N");
script_tag(name:"severity_origin", value:"NVD");
script_tag(name:"severity_date", value:"2019-02-22 17:36:28 +0000 (Fri, 22 Feb 2019)");
script_name("Debian: Security Advisory (DLA-1708-1)");
script_category(ACT_GATHER_INFO);
script_copyright("Copyright (C) 2019 Greenbone AG");
script_family("Debian Local Security Checks");
script_dependencies("gather-package-list.nasl");
script_mandatory_keys("ssh/login/debian_linux", "ssh/login/packages", re:"ssh/login/release=DEB8");
script_xref(name:"Advisory-ID", value:"DLA-1708-1");
script_xref(name:"URL", value:"https://www.debian.org/lts/security/2019/DLA-1708-1");
script_xref(name:"URL", value:"https://wiki.debian.org/LTS");
script_tag(name:"summary", value:"The remote host is missing an update for the Debian 'zabbix' package(s) announced via the DLA-1708-1 advisory.");
script_tag(name:"vuldetect", value:"Checks if a vulnerable package version is present on the target host.");
script_tag(name:"insight", value:"Several security vulnerabilities were discovered in Zabbix, a server/client network monitoring solution.
CVE-2016-10742
Zabbix allowed remote attackers to redirect to external links by misusing the request parameter.
CVE-2017-2826
An information disclosure vulnerability exists in the iConfig proxy request of Zabbix server. A specially crafted iConfig proxy request can cause the Zabbix server to send the configuration information of any Zabbix proxy, resulting in information disclosure. An attacker can make requests from an active Zabbix proxy to trigger this vulnerability.
This update also includes several other bug fixes and improvements. For more information please refer to the upstream changelog file.
For Debian 8 Jessie, these problems have been fixed in version 1:2.2.23+dfsg-0+deb8u1.
We recommend that you upgrade your zabbix packages.
Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: [link moved to references]");
script_tag(name:"affected", value:"'zabbix' package(s) on Debian 8.");
script_tag(name:"solution", value:"Please install the updated package(s).");
script_tag(name:"solution_type", value:"VendorFix");
script_tag(name:"qod_type", value:"package");
exit(0);
}
include("revisions-lib.inc");
include("pkg-lib-deb.inc");
release = dpkg_get_ssh_release();
if(!release)
exit(0);
res = "";
report = "";
if(release == "DEB8") {
if(!isnull(res = isdpkgvuln(pkg:"zabbix-agent", ver:"1:2.2.23+dfsg-0+deb8u1", rls:"DEB8"))) {
report += res;
}
if(!isnull(res = isdpkgvuln(pkg:"zabbix-frontend-php", ver:"1:2.2.23+dfsg-0+deb8u1", rls:"DEB8"))) {
report += res;
}
if(!isnull(res = isdpkgvuln(pkg:"zabbix-java-gateway", ver:"1:2.2.23+dfsg-0+deb8u1", rls:"DEB8"))) {
report += res;
}
if(!isnull(res = isdpkgvuln(pkg:"zabbix-proxy-mysql", ver:"1:2.2.23+dfsg-0+deb8u1", rls:"DEB8"))) {
report += res;
}
if(!isnull(res = isdpkgvuln(pkg:"zabbix-proxy-pgsql", ver:"1:2.2.23+dfsg-0+deb8u1", rls:"DEB8"))) {
report += res;
}
if(!isnull(res = isdpkgvuln(pkg:"zabbix-proxy-sqlite3", ver:"1:2.2.23+dfsg-0+deb8u1", rls:"DEB8"))) {
report += res;
}
if(!isnull(res = isdpkgvuln(pkg:"zabbix-server-mysql", ver:"1:2.2.23+dfsg-0+deb8u1", rls:"DEB8"))) {
report += res;
}
if(!isnull(res = isdpkgvuln(pkg:"zabbix-server-pgsql", ver:"1:2.2.23+dfsg-0+deb8u1", rls:"DEB8"))) {
report += res;
}
if(report != "") {
security_message(data:report);
} else if(__pkg_match) {
exit(99);
}
exit(0);
}
exit(0);
Transform Your Security Services
Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.
Book a live demo