Bug 1013963 (CVE-2013-5572) - CVE-2013-5572 zabbix: password leakage
Summary: CVE-2013-5572 zabbix: password leakage
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2013-5572
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1013964 1013965 1016869
Blocks: 1013967
TreeView+ depends on / blocked
 
Reported: 2013-10-01 07:22 UTC by Ratul Gupta
Modified: 2019-09-29 13:08 UTC (History)
9 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2014-05-30 04:32:19 UTC
Embargoed:

Attachments (Terms of Use)

Description Ratul Gupta 2013-10-01 07:22:12 UTC 
Zabbix, a network management system application designed to monitor and track the status of various network services, is found to have a vulnerability that could lead to password leakage.

Once the user is able to open a console session in zabbix, he can access the tab where various users of the system are displayed. An impersonated user can view the application source code, and could find the password that interacts zabbix, for eg, with a domain controller.

The field that should be looked for in the source code of the website is:
   type = "password" id = "ldap_bind_password" name = "ldap_bind_password" value = <password>.

And also if the user requests to refresh the web page, the browser asks the user to store or cache the password, which could also lead to password leakage.
Comment 1 Ratul Gupta 2013-10-01 07:26:47 UTC 
Created zabbix tracking bugs for this issue:

Affects: fedora-all [bug 1013964]
Affects: epel-all [bug 1013965]
Comment 2 Vincent Danen 2013-10-01 14:19:42 UTC 
This was reported on full-disclosure: http://archives.neohapsis.com/archives/fulldisclosure/2013-09/0149.html
Comment 3 Volker Fröhlich 2013-10-01 14:34:46 UTC 
The description is vague and they didn't bother to mention the upstream status. Assumptions are, this resembles https://support.zabbix.com/browse/ZBX-6721.
Comment 4 Vincent Danen 2013-10-08 20:24:07 UTC 
That reference looks correct to me.
Comment 7 Volker Fröhlich 2014-01-24 15:34:53 UTC 
Upstream confirms that the CVE resembles ZBX-6721. It will be fixed in 2.0.11 and 2.2.2, but foresee-ably not 1.8. The reason is, that the CVE is not considered that dangerous.
Comment 8 Fedora Update System 2014-03-02 19:24:10 UTC 
zabbix20-2.0.11-1.el6 has been pushed to the Fedora EPEL 6 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 9 Fedora Update System 2014-03-02 19:24:38 UTC 
zabbix20-2.0.11-1.el5 has been pushed to the Fedora EPEL 5 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 10 Fedora Update System 2014-03-02 19:25:15 UTC 
zabbix-1.8.20-1.el6 has been pushed to the Fedora EPEL 6 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 11 Fedora Update System 2014-05-01 22:20:37 UTC 
zabbix-2.0.11-3.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 12 Fedora Update System 2014-05-01 22:21:03 UTC 
zabbix-2.0.11-3.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.
Note You need to log in before you can comment on or make changes to this bug.