Bug 2255117 (CVE-2023-32726) - CVE-2023-32726 zabbix: possible buffer overread form DNS responses
Summary: CVE-2023-32726 zabbix: possible buffer overread form DNS responses
Keywords:
Status: NEW
Alias: CVE-2023-32726
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2255118 2255119
Blocks: 2255040
TreeView+ depends on / blocked
 
Reported: 2023-12-18 18:06 UTC by Robb Gatica
Modified: 2023-12-19 05:13 UTC (History)
0 users

Fixed In Version: zabbix 5.0.40, zabbix 6.0.24, zabbix 6.4.9, zabbix 7.0.0alpha8
Doc Type: ---
Doc Text:
A flaw was discovered in Zabbix. In certain conditions, DNS requests can cause the application to read beyond the boundary of a defined memory buffer. This may lead to exposure of sensitive information, a system crash, or arbitrary code execution.
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description Robb Gatica 2023-12-18 18:06:27 UTC 
Description:
This vulnerability is caused by improper check for RDLENGTH, if it overflows the buffer in response from DNS server.

Affected versions: 
5.0.0-5.0.39, 6.0.0-6.0.23, 6.4.0-6.4.8, 7.0.0alpha1-7.0.0alpha6

Reference: https://support.zabbix.com/browse/ZBX-23855
Comment 1 Robb Gatica 2023-12-18 18:06:44 UTC 
Created zabbix tracking bugs for this issue:

Affects: epel-all [bug 2255118]
Affects: fedora-all [bug 2255119]
Note You need to log in before you can comment on or make changes to this bug.