medium6.8Public exploit code
CVE-2009-4498
The node_process_command function in Zabbix Server before 1.8 allows remote attackers to execute arbitrary commands via a crafted request.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Zabbix Server - Arbitrary Command Execution (Metasploit)2012-08-27 · remote · linux · Verified
- Zabbix Server - Multiple Vulnerabilities2009-12-14 · webapps · multiple · Verified
Impact
The node_process_command function in Zabbix Server before 1.8 allows remote attackers to execute arbitrary commands via a crafted request.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Zabbix | Zabbix | through 1.7.4 Versions 1.1.2, 1.1.3, 1.1.4, 1.1.5, 1.4.2 |
Weakness classification
References
- NVD record
- CVE.org record
- http://secunia.com/advisories/37740
- http://www.openwall.com/lists/oss-security/2010/04/02/1
- http://www.securityfocus.com/archive/1/508436/30/60/threaded
- http://www.vupen.com/english/advisories/2009/3514
- https://support.zabbix.com/browse/ZBX-1030
- http://secunia.com/advisories/37740
- http://www.openwall.com/lists/oss-security/2010/04/02/1
- http://www.securityfocus.com/archive/1/508436/30/60/threaded
- http://www.vupen.com/english/advisories/2009/3514
- https://support.zabbix.com/browse/ZBX-1030