The user.login function in Zabbix before 1.8.16 and 2.x before 2.0.5rc1 allows remote attackers to override LDAP configuration via the cnf parameter.

The remote host is affected by the vulnerability described in GLSA-201311-15 (Zabbix: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Zabbix. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker may be able to execute arbitrary SQL statements, cause       a Denial of Service condition, or obtain sensitive information.
  Workaround :

    There is no known workaround at this time.

According to its self-reported version number, the instance of Zabbix listening on the remote host is a version greater than 1.8.1 prior to 1.8.16, or version 2.0.x prior to 2.0.5.  It, therefore, could be affected by an authentication bypass flaw in the 'user.login' method. The issue is triggered when LDAP authentication requests passed via the 'cnf' parameter are not properly handled.  A remote attacker could override the stored LDAP settings to redirect to authentication. 

Note that Nessus has not tested for these issues but has instead relied on the version in the Zabbix login page.

Solves CVE-2013-1364, see

http://sourceforge.net/mailarchive/forum.php?thread_name=50F832DA.5090 407%40zabbix.com&forum_name=zabbix-announce New upstream release 2.0.4

This build contains additional patches for :

  - ZBX-6101 -- SNMP traps were not processed in     maintenances with data collection

  - ZBX-3379 -- SNMP polling stopped working when the server     was bound to an interface This build contains the patch     for ZBX-6101, where SNMP traps were not processed in     maintenances with data collection.

The agent pre-uninstall script was unintentionally empty. It now now stops the agent and removes the agent from chkconfig, like it should.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Solves CVE-2013-1364, see

http://sourceforge.net/mailarchive/forum.php?thread_name=50F832DA.5090 407%40zabbix.com&forum_name=zabbix-announce

Release notes :

http://www.zabbix.com/rn1.8.16.php

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
71089	GLSA-201311-15 : Zabbix: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
66945	Zabbix < 1.8.16 / 2.0.5 / 2.1.0 user.login cnf Parameter Authentication Bypass	Nessus	CGI abuses	medium
64273	Fedora 18 : zabbix-2.0.4-3.fc18 (2013-1082)	Nessus	Fedora Local Security Checks	medium
64269	Fedora 17 : zabbix-1.8.16-1.fc17 (2013-1002)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2013-1364

critical

Tenable Plugins

high

medium

medium

medium