libs/zbxmedia/eztexting.c in Zabbix 1.8.x before 1.8.18rc1, 2.0.x before 2.0.8rc1, and 2.1.x before 2.1.2 does not properly set the CURLOPT_SSL_VERIFYHOST option for libcurl, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

- New upstream version 2.0.8

    - Patch for CVE-2013-5743 (SQL injection vulnerability,       ZBX-7091)

    - Patch for ZBX-6922 (Failing host XML import)

    - SQL speed-up patch for graphs (ZBX-6804)

    - Require php-ldap and ZBX-6992 (Service SQL)

    - Create and configure a spooling directory for fping       files outside of /tmp

    - Update README to reflect that and add a SELinux       section

    - Drop PrivateTmp from systemd unit files This update       solves a security issue involving the use of libcurl       in the code used to access the eztexting service. It       potentially allows for man-in-the-middle attacks. The       issue was described as CVE-2012-6086.

Please refer to https://support.zabbix.com/browse/ZBX-5924 for details!

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update solves a security issue involving the use of libcurl in the code used to access the eztexting service. It potentially allows for man-in-the-middle attacks. The issue was described as CVE-2012-6086.

Please refer to https://support.zabbix.com/browse/ZBX-5924 for details!

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
70426	Fedora 19 : zabbix-2.0.8-3.fc19 (2013-18351)	Nessus	Fedora Local Security Checks	medium
70425	Fedora 18 : zabbix-2.0.8-3.fc18 (2013-18348)	Nessus	Fedora Local Security Checks	medium
70422	Fedora 20 : zabbix-2.0.8-3.fc20 (2013-18314)	Nessus	Fedora Local Security Checks	medium
70203	Fedora 19 : zabbix-2.0.6-3.fc19 (2013-14029)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2012-6086

medium

Tenable Plugins

medium

medium

medium

medium