kpriv/freebsd-ports
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

- Mark FORBIDDEN: multiple vulnerabilities

Browse source 
Note:

Input appended to and passed via the "extlang" parameter to the "calc_exp2()"
function in include/validate.inc.php is not properly sanitised before being
used. This can be exploited to inject and execute arbitrary PHP code.

The application allows users to perform certain actions via HTTP requests without
performing any validity checks to verify the requests. This can be exploited to e.g.
create users by enticing a logged in administrator to visit a malicious web page.

Input passed to the "srclang" parameter in locales.php (when "next" is set to a non-NULL
value) is not properly verified before being used to include files. This can be
exploited to include arbitrary files from local resources via directory traversal
attacks and URL-encoded NULL bytes.

Original Advisory:
http://www.ush.it/team/ush/hack-zabbix_162/adv.txt

With hat:	secteam
Security:	http://www.vuxml.org/freebsd/03140526-1250-11de-a964-0030843d3802.html
This commit is contained in:
Martin Wilke 2009-03-16 17:48:48 +00:00
parent fb403bfc93
commit 519a314870
Notes: svn2git 2021-03-31 03:12:20 +00:00 
svn path=/head/; revision=230236
4 changed files with 8 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
net-mgmt/zabbix-agent/Makefile
View file

@ -24,6 +24,8 @@ MAKE_ARGS= ARCH=freebsd
CONFIGURE_ARGS+=--enable-ipv6
.endif
FORBIDDEN= multiple vulnerabilities http://www.vuxml.org/freebsd/03140526-1250-11de-a964-0030843d3802.html
ZABBIX_BIN= agent agentd get sender
ZABBIX_CFG= agent agentd
ZABBIX_BINFILES=${ZABBIX_BIN:S|^|zabbix_|:C|.+|&/&|:S|agentd/|agent/|}

2
net-mgmt/zabbix/Makefile
View file

@ -38,6 +38,8 @@ SUB_FILES= pkg-message
.include <bsd.port.pre.mk>
FORBIDDEN= multiple vulnerabilities http://www.vuxml.org/freebsd/03140526-1250-11de-a964-0030843d3802.html
.ifndef WITHOUT_JABBER
USE_JABBER= yes
CONFIGURE_ARGS+=--with-jabber=${LOCALBASE}

2
net-mgmt/zabbix2-agent/Makefile
View file

@ -24,6 +24,8 @@ MAKE_ARGS= ARCH=freebsd
CONFIGURE_ARGS+=--enable-ipv6
.endif
FORBIDDEN= multiple vulnerabilities http://www.vuxml.org/freebsd/03140526-1250-11de-a964-0030843d3802.html
ZABBIX_BIN= agent agentd get sender
ZABBIX_CFG= agent agentd
ZABBIX_BINFILES=${ZABBIX_BIN:S|^|zabbix_|:C|.+|&/&|:S|agentd/|agent/|}

2
net-mgmt/zabbix2/Makefile
View file

@ -38,6 +38,8 @@ SUB_FILES= pkg-message
.include <bsd.port.pre.mk>
FORBIDDEN= multiple vulnerabilities http://www.vuxml.org/freebsd/03140526-1250-11de-a964-0030843d3802.html
.ifndef WITHOUT_JABBER
USE_JABBER= yes
CONFIGURE_ARGS+=--with-jabber=${LOCALBASE}