Description
The NET_TCP_LISTEN function in net.c in Zabbix Agent before 1.6.7, when running on FreeBSD or Solaris, allows remote attackers to bypass the EnableRemoteCommands setting and execute arbitrary commands via shell metacharacters in the argument to net.tcp.listen. NOTE: this attack is limited to attacks from trusted IP addresses.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | zabbix | 1:1.8-1 | — |
| Debian 13 | zabbix | 1:1.8-1 | — |
| Debian 12 | zabbix | 1:1.8-1 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
Zabbix Agent net.tcp.listen Command Injection
exploit/unix/misc/zabbix_agent_exec
Exploit-DB 2
- Zabbix Agent - 'net.tcp.listen' Command Injection (Metasploit) EDB-16918 · remote · Jul 3, 2010 · verified
- Zabbix Agent < 1.6.7 - Remote Bypass EDB-10431 · webapps · Dec 14, 2009 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 20091213 Zabbix Agent : Bypass of EnableRemoteCommands=0 mailing-list
- https://support.zabbix.com/browse/ZBX-1032
- 37740 third-party-advisory
- ADV-2009-3514 vdb-entry