Permissions, Privileges, and Access Controls in zabbix (Alpine package)

1) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU33097

Risk: Low

CVSSv4.0: 2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/U:Clear]

CVE-ID: CVE-2013-5572

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: Yes

Description

The vulnerability allows a remote #AU# to gain access to sensitive information.

Zabbix 2.0.5 allows remote authenticated users to discover the LDAP bind password by leveraging management-console access and reading the ldap_bind_password value in the HTML source code.

Mitigation

Install update from vendor's website.

Vulnerable software versions

zabbix (Alpine package): 1.8.19-r0 - 2.0.10-r0

net-snmp (Alpine package): 5.7.1-r3

CPE2.3

• cpe:2.3:a:alpine:zabbix_alpine_package:1.8.19-r0:*:*:*:*:alpine_linux:*:2.4
• cpe:2.3:a:alpine:zabbix_alpine_package:2.0.10-r0:*:*:*:*:alpine_linux:*:2.6
• cpe:2.3:a:alpine:net-snmp_alpine_package:5.7.1-r3:*:*:*:*:alpine_linux:*:2.4

External links

https://git.alpinelinux.org/aports/commit/?id=1143d93aa87508538af8394de6ea2d7448da76a7
https://git.alpinelinux.org/aports/commit/?id=69d5ba09d08d7ada4503154e51646e5bd67adf34
https://git.alpinelinux.org/aports/commit/?id=870d04b5a1a7a9fca5bb0db44e923d8cd71e0fe5

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.