Vulnerability Name:

CVE-2008-1381 (CCN-42046)

Assigned:2008-04-28
Published:2008-04-28
Updated:2017-08-08
Summary:ZoneMinder before 1.23.3 allows remote authenticated users, and possibly unauthenticated attackers in some installations, to execute arbitrary commands via shell metacharacters in a crafted URL.
The following link contains patch information: http://www.zoneminder.com/wiki/index.php/1.23.2_Patches
CVSS v3 Severity:4.6 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): High
Privileges Required (PR): Low
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): Low
CVSS v2 Severity:7.5 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
5.5 Medium (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
6.0 Medium (CCN CVSS v2 Vector: AV:N/AC:M/Au:S/C:P/I:P/A:P)
4.4 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:S/C:P/I:P/A:P/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
Vulnerability Type:CWE-94
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2008-1381

Source: CCN
Type: SA29995
ZoneMinder Unspecified Code Execution Vulnerabilities

Source: SECUNIA
Type: Vendor Advisory
29995

Source: SECUNIA
Type: UNKNOWN
30189

Source: MISC
Type: UNKNOWN
http://www.awe.com/mark/blog/200804272230.html

Source: CCN
Type: OSVDB ID: 44605
ZoneMinder Multiple Unspecified Arbitrary Remote Code Execution

Source: BID
Type: UNKNOWN
28968

Source: CCN
Type: BID-28968
ZoneMinder Multiple Unspecified Remote Code Execution Vulnerabilities

Source: CCN
Type: ZoneMinder Web site
Downloads

Source: CCN
Type: ZoneMinder Change History, Release 1.23.3
Import security fixes and other minor changes

Source: CONFIRM
Type: UNKNOWN
http://www.zoneminder.com/wiki/index.php/Change_History#Release_1.23.3

Source: XF
Type: UNKNOWN
zoneminder-unspecified-code-execution(42046)

Source: XF
Type: UNKNOWN
zoneminder-unspecified-code-execution(42046)

Source: FEDORA
Type: UNKNOWN
FEDORA-2008-3516

Source: FEDORA
Type: UNKNOWN
FEDORA-2008-3462

Vulnerable Configuration:Configuration 1:
  • cpe:/a:zoneminder:zoneminder:0.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:zoneminder:zoneminder:0.9.7:*:*:*:*:*:*:*
  • OR cpe:/a:zoneminder:zoneminder:0.9.8:*:*:*:*:*:*:*
  • OR cpe:/a:zoneminder:zoneminder:0.9.9:*:*:*:*:*:*:*
  • OR cpe:/a:zoneminder:zoneminder:0.9.10:*:*:*:*:*:*:*
  • OR cpe:/a:zoneminder:zoneminder:0.9.11:*:*:*:*:*:*:*
  • OR cpe:/a:zoneminder:zoneminder:0.9.12:*:*:*:*:*:*:*
  • OR cpe:/a:zoneminder:zoneminder:0.9.13:*:*:*:*:*:*:*
  • OR cpe:/a:zoneminder:zoneminder:0.9.14:*:*:*:*:*:*:*
  • OR cpe:/a:zoneminder:zoneminder:0.9.15:*:*:*:*:*:*:*
  • OR cpe:/a:zoneminder:zoneminder:0.9.16:*:*:*:*:*:*:*
  • OR cpe:/a:zoneminder:zoneminder:1.17.0:*:*:*:*:*:*:*
  • OR cpe:/a:zoneminder:zoneminder:1.17.1:*:*:*:*:*:*:*
  • OR cpe:/a:zoneminder:zoneminder:1.17.2:*:*:*:*:*:*:*
  • OR cpe:/a:zoneminder:zoneminder:1.18.0:*:*:*:*:*:*:*
  • OR cpe:/a:zoneminder:zoneminder:1.18.1:*:*:*:*:*:*:*
  • OR cpe:/a:zoneminder:zoneminder:1.19.0:*:*:*:*:*:*:*
  • OR cpe:/a:zoneminder:zoneminder:1.19.1:*:*:*:*:*:*:*
  • OR cpe:/a:zoneminder:zoneminder:1.19.2:*:*:*:*:*:*:*
  • OR cpe:/a:zoneminder:zoneminder:1.19.3:*:*:*:*:*:*:*
  • OR cpe:/a:zoneminder:zoneminder:1.19.4:*:*:*:*:*:*:*
  • OR cpe:/a:zoneminder:zoneminder:1.19.5:*:*:*:*:*:*:*
  • OR cpe:/a:zoneminder:zoneminder:1.20.0:*:*:*:*:*:*:*
  • OR cpe:/a:zoneminder:zoneminder:1.20.1:*:*:*:*:*:*:*
  • OR cpe:/a:zoneminder:zoneminder:1.21.0:*:*:*:*:*:*:*
  • OR cpe:/a:zoneminder:zoneminder:1.21.1:*:*:*:*:*:*:*
  • OR cpe:/a:zoneminder:zoneminder:1.21.2:*:*:*:*:*:*:*
  • OR cpe:/a:zoneminder:zoneminder:1.21.3:*:*:*:*:*:*:*
  • OR cpe:/a:zoneminder:zoneminder:1.21.4:*:*:*:*:*:*:*
  • OR cpe:/a:zoneminder:zoneminder:1.22.0:*:*:*:*:*:*:*
  • OR cpe:/a:zoneminder:zoneminder:1.22.1:*:*:*:*:*:*:*
  • OR cpe:/a:zoneminder:zoneminder:1.22.2:*:*:*:*:*:*:*
  • OR cpe:/a:zoneminder:zoneminder:1.22.3:*:*:*:*:*:*:*
  • OR cpe:/a:zoneminder:zoneminder:1.23.0:*:*:*:*:*:*:*
  • OR cpe:/a:zoneminder:zoneminder:1.23.1:*:*:*:*:*:*:*
  • OR cpe:/a:zoneminder:zoneminder:1.23.2:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:zoneminder:zoneminder:0.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:zoneminder:zoneminder:0.9.10:*:*:*:*:*:*:*
  • OR cpe:/a:zoneminder:zoneminder:0.9.11:*:*:*:*:*:*:*
  • OR cpe:/a:zoneminder:zoneminder:0.9.12:*:*:*:*:*:*:*
  • OR cpe:/a:zoneminder:zoneminder:0.9.13:*:*:*:*:*:*:*
  • OR cpe:/a:zoneminder:zoneminder:0.9.14:*:*:*:*:*:*:*
  • OR cpe:/a:zoneminder:zoneminder:0.9.15:*:*:*:*:*:*:*
  • OR cpe:/a:zoneminder:zoneminder:0.9.16:*:*:*:*:*:*:*
  • OR cpe:/a:zoneminder:zoneminder:0.9.7:*:*:*:*:*:*:*
  • OR cpe:/a:zoneminder:zoneminder:0.9.8:*:*:*:*:*:*:*
  • OR cpe:/a:zoneminder:zoneminder:0.9.9:*:*:*:*:*:*:*
  • OR cpe:/a:zoneminder:zoneminder:1.17.0:*:*:*:*:*:*:*
  • OR cpe:/a:zoneminder:zoneminder:1.17.2:*:*:*:*:*:*:*
  • OR cpe:/a:zoneminder:zoneminder:1.18.0:*:*:*:*:*:*:*
  • OR cpe:/a:zoneminder:zoneminder:1.18.1:*:*:*:*:*:*:*
  • OR cpe:/a:zoneminder:zoneminder:1.19.0:*:*:*:*:*:*:*
  • OR cpe:/a:zoneminder:zoneminder:1.19.1:*:*:*:*:*:*:*
  • OR cpe:/a:zoneminder:zoneminder:1.19.2:*:*:*:*:*:*:*
  • OR cpe:/a:zoneminder:zoneminder:1.19.3:*:*:*:*:*:*:*
  • OR cpe:/a:zoneminder:zoneminder:1.19.4:*:*:*:*:*:*:*
  • OR cpe:/a:zoneminder:zoneminder:1.19.5:*:*:*:*:*:*:*
  • OR cpe:/a:zoneminder:zoneminder:1.20.0:*:*:*:*:*:*:*
  • OR cpe:/a:zoneminder:zoneminder:1.20.1:*:*:*:*:*:*:*
  • OR cpe:/a:zoneminder:zoneminder:1.21.0:*:*:*:*:*:*:*
  • OR cpe:/a:zoneminder:zoneminder:1.21.1:*:*:*:*:*:*:*
  • OR cpe:/a:zoneminder:zoneminder:1.21.2:*:*:*:*:*:*:*
  • OR cpe:/a:zoneminder:zoneminder:1.21.3:*:*:*:*:*:*:*
  • OR cpe:/a:zoneminder:zoneminder:1.21.4:*:*:*:*:*:*:*
  • OR cpe:/a:zoneminder:zoneminder:1.22.0:*:*:*:*:*:*:*
  • OR cpe:/a:zoneminder:zoneminder:1.22.1:*:*:*:*:*:*:*
  • OR cpe:/a:zoneminder:zoneminder:1.22.2:*:*:*:*:*:*:*
  • OR cpe:/a:zoneminder:zoneminder:1.22.3:*:*:*:*:*:*:*
  • OR cpe:/a:zoneminder:zoneminder:1.23.0:*:*:*:*:*:*:*
  • OR cpe:/a:zoneminder:zoneminder:1.23.1:*:*:*:*:*:*:*
  • OR cpe:/a:zoneminder:zoneminder:1.23.2:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    zoneminder zoneminder 0.0.1
    zoneminder zoneminder 0.9.7
    zoneminder zoneminder 0.9.8
    zoneminder zoneminder 0.9.9
    zoneminder zoneminder 0.9.10
    zoneminder zoneminder 0.9.11
    zoneminder zoneminder 0.9.12
    zoneminder zoneminder 0.9.13
    zoneminder zoneminder 0.9.14
    zoneminder zoneminder 0.9.15
    zoneminder zoneminder 0.9.16
    zoneminder zoneminder 1.17.0
    zoneminder zoneminder 1.17.1
    zoneminder zoneminder 1.17.2
    zoneminder zoneminder 1.18.0
    zoneminder zoneminder 1.18.1
    zoneminder zoneminder 1.19.0
    zoneminder zoneminder 1.19.1
    zoneminder zoneminder 1.19.2
    zoneminder zoneminder 1.19.3
    zoneminder zoneminder 1.19.4
    zoneminder zoneminder 1.19.5
    zoneminder zoneminder 1.20.0
    zoneminder zoneminder 1.20.1
    zoneminder zoneminder 1.21.0
    zoneminder zoneminder 1.21.1
    zoneminder zoneminder 1.21.2
    zoneminder zoneminder 1.21.3
    zoneminder zoneminder 1.21.4
    zoneminder zoneminder 1.22.0
    zoneminder zoneminder 1.22.1
    zoneminder zoneminder 1.22.2
    zoneminder zoneminder 1.22.3
    zoneminder zoneminder 1.23.0
    zoneminder zoneminder 1.23.1
    zoneminder zoneminder 1.23.2
    zoneminder zoneminder 0.0.1
    zoneminder zoneminder 0.9.10
    zoneminder zoneminder 0.9.11
    zoneminder zoneminder 0.9.12
    zoneminder zoneminder 0.9.13
    zoneminder zoneminder 0.9.14
    zoneminder zoneminder 0.9.15
    zoneminder zoneminder 0.9.16
    zoneminder zoneminder 0.9.7
    zoneminder zoneminder 0.9.8
    zoneminder zoneminder 0.9.9
    zoneminder zoneminder 1.17.0
    zoneminder zoneminder 1.17.2
    zoneminder zoneminder 1.18.0
    zoneminder zoneminder 1.18.1
    zoneminder zoneminder 1.19.0
    zoneminder zoneminder 1.19.1
    zoneminder zoneminder 1.19.2
    zoneminder zoneminder 1.19.3
    zoneminder zoneminder 1.19.4
    zoneminder zoneminder 1.19.5
    zoneminder zoneminder 1.20.0
    zoneminder zoneminder 1.20.1
    zoneminder zoneminder 1.21.0
    zoneminder zoneminder 1.21.1
    zoneminder zoneminder 1.21.2
    zoneminder zoneminder 1.21.3
    zoneminder zoneminder 1.21.4
    zoneminder zoneminder 1.22.0
    zoneminder zoneminder 1.22.1
    zoneminder zoneminder 1.22.2
    zoneminder zoneminder 1.22.3
    zoneminder zoneminder 1.23.0
    zoneminder zoneminder 1.23.1
    zoneminder zoneminder 1.23.2