Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2009-4502

The NET_TCP_LISTEN function in net.c in Zabbix Agent before 1.6.7, when running on FreeBSD or Solaris, allows remote attackers to bypass the EnableRemoteCommands setting and execute arbitrary commands via shell metacharacters in the argument to net.tcp.listen. NOTE: this attack is limited to attacks from trusted IP addresses.

Published

2009-12-31T18:30:01.797

Last Modified

2025-04-09T00:30:58.490

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 9.3 (HIGH)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

  • Access Vector: NETWORK
  • Access Complexity: MEDIUM
  • Authentication: NONE
  • Confidentiality Impact: COMPLETE
  • Integrity Impact: COMPLETE
  • Availability Impact: COMPLETE
Exploitability Score

8.6

Impact Score

10.0

Weaknesses
  • Type: Primary
    CWE-264
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application zabbix zabbix ≤ 1.6.6 Yes
Application zabbix zabbix 1.1.2 Yes
Application zabbix zabbix 1.1.3 Yes
Application zabbix zabbix 1.1.4 Yes
Application zabbix zabbix 1.1.5 Yes
Application zabbix zabbix 1.4.2 Yes
Application zabbix zabbix 1.4.3 Yes
Application zabbix zabbix 1.4.4 Yes
Application zabbix zabbix 1.4.6 Yes
Operating System freebsd freebsd * No
Operating System sun solaris * No
References