Bug 1448392 (CVE-2017-2824, CVE-2017-2825)

Summary:	CVE-2017-2824 CVE-2017-2825 zabbix: Multiple vulnerabilities
Product:	[Other] Security Response	Reporter:	Andrej Nemec <anemec>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	brett.lentz, ccoleman, dan, dedgar, dmcphers, jgoulding, joelsmith, nelsonab, orion, volker27
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-10-21 11:53:19 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1448396, 1448393, 1448394, 1448395
Bug Blocks:

Description Andrej Nemec 2017-05-05 10:57:40 UTC

Two vulnerabilities in the Zabbix server were reported by the Cisco TALOS. 

CVE-2017-2824
TALOS-2017-0325
Zabbix Server Active Proxy Trapper Remote Code Execution Vulnerability

An exploitable code execution vulnerability exists in the trapper command functionality of Zabbix Server 2.4.X . A specially crafted set of packets can cause a command injection resulting in remote code execution. An attacker can make requests from an active Zabbix Proxy to trigger this vulnerability.

http://www.talosintelligence.com/reports/TALOS-2017-0325/

CVE-2017-2825
TALOS-2017-0326
Zabbix Proxy Server SQL Database Write Vulnerability

An exploitable database write vulnerability exists in the trapper functionality of Zabbix Server 2.4.X . Specifically crafted trapper packets can pass database logic checks, resulting in database writes. An attacker set up a Man-in-the-Middle server to alter trapper requests made between an active Zabbix proxy and Server to trigger this vulnerability.

http://www.talosintelligence.com/reports/TALOS-2017-0326/

Comment 1 Andrej Nemec 2017-05-05 10:58:25 UTC

Created zabbix tracking bugs for this issue:

Affects: epel-6 [bug 1448394]
Affects: openshift-1 [bug 1448396]


Created zabbix20 tracking bugs for this issue:

Affects: epel-all [bug 1448393]


Created zabbix22 tracking bugs for this issue:

Affects: epel-all [bug 1448395]

Comment 2 Volker Fröhlich 2017-06-24 10:44:46 UTC

Upstream issue: https://support.zabbix.com/browse/ZBX-12075

Comment 3 Volker Fröhlich 2017-06-24 10:45:37 UTC

and https://support.zabbix.com/browse/ZBX-12074