Summary
Fu Chuang discovered that Zabbix did not properly parse IPs. A remote
attacker could possibly use this issue to execute arbitrary code. This
issue only affected Ubuntu 14.04 ESM, Ubuntu 16.04 ESM and Ubuntu 18.04 ESM.
(CVE-2020-11800)
It was discovered that Zabbix incorrectly handled certain requests. A
remote attacker could possibly use this issue to execute arbitrary code.
This issue only affected Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.
(CVE-2017-2824, CVE-2017-2825)
It was discovered that Zabbix incorrectly handled certain XML files. A
remote attacker could possibly use this issue to read arbitrary files or
potentially execute arbitrary code. This issue only affected
Ubuntu 14.04 ESM. (CVE-2014-3005)
It was discovered that Zabbix incorrectly handled certain inputs. A remote
attacker could possibly use this issue to execute arbitrary SQL commands.
This issue only affected Ubuntu 14.04 ESM. (CVE-2016-10134, CVE-2016-4338)
It was discovered that Zabbix incorrectly handled the request parameter. A
remote attacker could possibly use this issue to redirect requests to
external links. This issue only affected Ubuntu 14.04 ESM and
Ubuntu 18.04 ESM. (CVE-2016-10742)
It was discovered that Zabbix incorrectly handled failed login attempts. A
remote attacker could possibly use this issue to enumerate users.
(CVE-2019-15132)
It was discovered that Zabbix did not properly validate input. A remote
attacker could exploit this to conduct cross-site scripting (XSS) attacks.
This issue only affected Ubuntu 16.04 ESM, Ubuntu 18.04 ESM and
Ubuntu 20.04 ESM. (CVE-2020-15803)
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | zabbix | 1:2.2.2+dfsg-1ubuntu1+esm4 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | zabbix | 1:2.4.7+dfsg-2ubuntu2.1+esm3 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | zabbix | 1:3.0.12+dfsg-1ubuntu0.1~esm3 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | zabbix | 1:4.0.17+dfsg-1ubuntu0.1~esm1 |
Vulnerabilities 9
-
Critical 9.0CVE-2020-11800 Public exploit
Zabbix Server 2.2.x and 3.0.x before 3.0.31, and 3.2 allows remote attackers to execute arbitrary code.
-
Unscored —
XML external entity (XXE) vulnerability in Zabbix 1.8.x before 1.8.21rc1, 2.0.x before 2.0.13rc1, 2.2.x before 2.2.5rc1…
-
Unscored —
SQL injection vulnerability in Zabbix before 2.2.14 and 3.0 before 3.0.4 allows remote attackers to execute arbitrary S…
-
Unscored —
Zabbix before 2.2.21rc1, 3.x before 3.0.13rc1, 3.1.x and 3.2.x before 3.2.10rc1, and 3.3.x and 3.4.x before 3.4.4rc1 al…
-
Unscored —
The mysql user parameter configuration script (userparameter_mysql.conf) in the agent in Zabbix before 2.0.18, 2.2.x be…
-
Unscored —
An exploitable code execution vulnerability exists in the trapper command functionality of Zabbix Server 2.4.X. A speci…
-
Unscored —
In the trapper functionality of Zabbix Server 2.4.x, specifically crafted trapper packets can pass database logic check…
-
Unscored —
Zabbix through 4.4.0alpha1 allows User Enumeration. With login requests, it is possible to enumerate application userna…
-
Unscored —CVE-2020-15803 EPSS 32%
Zabbix before 3.0.32rc1, 4.x before 4.0.22rc1, 4.1.x through 4.4.x before 4.4.10rc1, and 5.x before 5.0.2rc1 allows sto…
References
-
report
https://ubuntu.com/security/CVE-2014-3005
-
report
https://ubuntu.com/security/CVE-2016-4338
-
report
https://ubuntu.com/security/CVE-2016-10134
-
report
https://ubuntu.com/security/CVE-2016-10742
-
report
https://ubuntu.com/security/CVE-2017-2824
-
report
https://ubuntu.com/security/CVE-2017-2825
-
report
https://ubuntu.com/security/CVE-2019-15132
-
report
https://ubuntu.com/security/CVE-2020-11800
-
report
https://ubuntu.com/security/CVE-2020-15803