SNS Vulnerability

Zabbix Latest Data SQL Injection Vulnerability

Description

(#An SQL injection was reported in Zabbix.#An authenticated remote attacker could exploit it in order to access sensitive data inside the database via specially crafted requests.##This vulnerability is triggerable via the "toggle_ids" in the "latest.php" web page.##Updated, 15/08/2016:#A proof of concept is available.#Updated, 08/09/2016:#This vulnerability is also triggerable via the "profileIdx2" parameter.##An exploitation code is available.#Updated, 12/01/2017:#The CVE-2016-10134 identifier has been assigned to this vulnerability.##The zabbix packages provided by Debian Jessie 8 are vulnerable.)

Vulnerable Products

Vulnerable OS:
GNU/Linux (Debian) - 8Vulnerable Software:
Zabbix (Zabbix) - 2.2.13, 3.0.3

Solution

Fixed zabbix packages for Debian Jessie 8 are available.

CVE

CVE-2016-10134

References

- Zabbix : SQL injection vulnerabilities in "Latest data"
https://support.zabbix.com/browse/ZBX-11023
- Debian Security Tracker : zabbix
https://security-tracker.debian.org/tracker/CVE-2016-10134
- DSA 3802-1 : zabbix security update
https://lists.debian.org/debian-security-announce/2017/msg00057.html

Vulnerability Manager Detection

IPS Protection

ASQ Engine alarm	Available Since
SQL injection Prevention - GET : suspicious OR statement in URL	3.2.0
SQL injection Prevention - GET : suspicious combination of 'OR' or 'AND' statements in URL	3.2.0
SQL injection Prevention - GET : suspicious CREATE statement in URL	3.2.0
SQL injection Prevention - GET : suspicious CAST statement in URL	3.2.0
SQL injection Prevention - GET : suspicious OPENROWSET statement in URL	3.2.0
SQL injection Prevention - GET : suspicious DECLARE statement in URL	3.2.0
SQL injection Prevention - GET : suspicious OPENQUERY statement in URL	3.2.0
SQL injection Prevention - GET : suspicious shutdown statement in URL	3.2.0
SQL injection Prevention - GET : suspicious UNION SELECT statement in URL	3.2.0
SQL injection Prevention - GET : possible database version probing	3.2.0
SQL injection Prevention - GET : suspicious UPDATE SET statement in URL	3.2.0
SQL injection Prevention - GET : suspicious SELECT statement in URL	3.2.0
SQL injection Prevention - GET : suspicious INSERT statement in URL	3.2.0
SQL injection Prevention - GET : suspicious DROP statement in URL	3.2.0
SQL injection Prevention - GET : suspicious EXEC statement in URL	3.2.0
SQL injection Prevention - GET : block comment delimiters in URL	3.2.0
SQL injection Prevention - GET : suspicious combination of 'select' and 'sleep' statements in URL	5.0.0
SQL injection Prevention - GET : Evasion attempt with CAST and EXEC statements	5.0.0
SQL injection Prevention - GET : Authentication bypass attempt with OR statement	5.0.0
SQL injection Prevention - GET : suspicious SQL keywords in URL	5.0.0

Risk level

Moderate

Vulnerability First Public Report Date

2016-07-22

Target Type

Server

Possible exploit

Remote