It was reported [1],[2] that the Zabbix frontend supported an XML data import feature, where on the server it used DOMDocument to parse the XML. By default, DOMDocument also parses the external DTD, which could allow a remote attacker to use a crafted XML file causing Zabbix to read an arbitrary local file, and send the contents of the specified file to a remote server. This is fixed upstream via: * svn://svn.zabbix.com/branches/dev/ZBX-8151-18 r46594 for 1.8 * svn://svn.zabbix.com/branches/dev/ZBX-8151-20 r46600 for 2.0+ [1] https://support.zabbix.com/browse/ZBX-8151 [2] http://www.pnigos.com/?p=273
Created zabbix22 tracking bugs for this issue: Affects: epel-6 [bug 1110500]
Created zabbix tracking bugs for this issue: Affects: fedora-all [bug 1110498] Affects: epel-6 [bug 1110499] Affects: epel-7 [bug 1110501]
Created zabbix20 tracking bugs for this issue: Affects: epel-all [bug 1110502]
zabbix-2.0.12-3.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.
zabbix-2.0.12-3.fc19 has been pushed to the Fedora 19 stable repository. If problems still persist, please make note of it in this bug report.
zabbix20-2.0.12-2.el6 has been pushed to the Fedora EPEL 6 stable repository. If problems still persist, please make note of it in this bug report.
zabbix20-2.0.12-2.el5 has been pushed to the Fedora EPEL 5 stable repository. If problems still persist, please make note of it in this bug report.
zabbix-1.8.20-2.el6 has been pushed to the Fedora EPEL 6 stable repository. If problems still persist, please make note of it in this bug report.