A security flaw was found in the way ZoneMinder, a camera monitoring and analysis tool, sanitized user provided input in certain circumstances. A remote authenticated user could use this flaw to execute arbitrary code with the privileges of the user running the web server. References: [1] http://www.openwall.com/lists/oss-security/2013/01/25/6 [2] http://itsecuritysolutions.org/2013-01-22-ZoneMinder-Video-Server-arbitrary-command-execution-vulnerability/ [3] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=698910 Public PoC: [4] https://github.com/rapid7/metasploit-framework/pull/1354
This issue affects the versions of the zoneminder package, as shipped with Fedora release of 16, 17, and 18. Please schedule an update (once there is final upstream patch available).
Created zoneminder tracking bugs for this issue Affects: fedora-all [bug 904104]
Wow, I don't even see any evidence that upstream even knows about this. They don't have mailing lists and there's no discussion on the forums. Will watch for any patch, but PHP is far from my best language so I'm not going to poke at this myself, especially when I have no chance of testing the X10 stuff. Fortunately it requires admin authentication first, and zoneminder is selinux-confined now, so it's not a huge emergency.
Jason, are you on the upstream forums? Are you able to maybe bring to their attention that this flaw exists (point them to this bug perhaps, or one of the references noted in #c0)? As an aside, this was just assigned CVE-2013-0232.
Yeah, I did so last week: http://www.zoneminder.com/forums/viewtopic.php?f=29&t=20771 I'd update that forum with the CVE link but it seem to go anywhere yet.
Hi Jason and Vincent In the Debian BTS[1] there is now a first patch for this. [1]: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=698910#23
This has been fixed upstream: https://github.com/ZoneMinder/ZoneMinder/issues/93
Zoneminder is no longer shipped in Fedora.