Vulnerability CVE-2017-2826

Vulnerability Name:

CVE-2017-2826 (CCN-141345)

Assigned:

2016-12-01

Published:

2018-04-09

Updated:

2019-03-13

Summary:

An information disclosure vulnerability exists in the iConfig proxy request of Zabbix server 2.4.X. A specially crafted iConfig proxy request can cause the Zabbix server to send the configuration information of any Zabbix proxy, resulting in information disclosure. An attacker can make requests from an active Zabbix proxy to trigger this vulnerability.

CVSS v3 Severity:

3.7 Low (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)
3.3 Low (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:U/RC:R)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): High Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): Low Integrity (I): None Availibility (A): None

3.7 Low (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)
3.3 Low (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:U/RC:R)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): High Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): Low Integrity (I): None Availibility (A): None

CVSS v2 Severity:

4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Authentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): None Availibility (A): None

2.6 Low (CCN CVSS v2 Vector: AV:N/AC:H/Au:N/C:P/I:N/A:N)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): High Athentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): None Availibility (A): None

Vulnerability Type:

CWE-200

Vulnerability Consequences:

Obtain Information

References:

Source: MITRE
Type: CNA
CVE-2017-2826

Source: XF
Type: UNKNOWN
zabbix-cve20172826-info-disc(141345)

Source: MLIST
Type: Mailing List, Third Party Advisory
[debian-lts-announce] 20190311 [SECURITY] [DLA 1708-1] zabbix security update

Source: MISC
Type: Exploit, Third Party Advisory
https://talosintelligence.com/vulnerability_reports/TALOS-2017-0327

Source: CCN
Type: Talos Vulnerability Report TALOS-2017-0327
Zabbix Server Config Proxy Request Information Disclosure Vulnerability

Source: CCN
Type: Zabbix Web site
Zabbix Server

Vulnerable Configuration:

Configuration 1:

cpe:/a:zabbix:zabbix:2.4.0:*:*:*:*:*:*:*

OR cpe:/a:zabbix:zabbix:2.4.0:rc1:*:*:*:*:*:*

OR cpe:/a:zabbix:zabbix:2.4.0:rc2:*:*:*:*:*:*

OR cpe:/a:zabbix:zabbix:2.4.0:rc3:*:*:*:*:*:*

OR cpe:/a:zabbix:zabbix:2.4.1:*:*:*:*:*:*:*

OR cpe:/a:zabbix:zabbix:2.4.1:rc1:*:*:*:*:*:*

OR cpe:/a:zabbix:zabbix:2.4.1:rc2:*:*:*:*:*:*

OR cpe:/a:zabbix:zabbix:2.4.2:*:*:*:*:*:*:*

OR cpe:/a:zabbix:zabbix:2.4.2:rc1:*:*:*:*:*:*

OR cpe:/a:zabbix:zabbix:2.4.3:*:*:*:*:*:*:*

OR cpe:/a:zabbix:zabbix:2.4.3:rc1:*:*:*:*:*:*

OR cpe:/a:zabbix:zabbix:2.4.4:*:*:*:*:*:*:*

OR cpe:/a:zabbix:zabbix:2.4.4:rc1:*:*:*:*:*:*

OR cpe:/a:zabbix:zabbix:2.4.5:*:*:*:*:*:*:*

OR cpe:/a:zabbix:zabbix:2.4.5:rc1:*:*:*:*:*:*

OR cpe:/a:zabbix:zabbix:2.4.6:*:*:*:*:*:*:*

OR cpe:/a:zabbix:zabbix:2.4.6:rc1:*:*:*:*:*:*

OR cpe:/a:zabbix:zabbix:2.4.7:*:*:*:*:*:*:*

OR cpe:/a:zabbix:zabbix:2.4.7:rc1:*:*:*:*:*:*

OR cpe:/a:zabbix:zabbix:2.4.8:*:*:*:*:*:*:*

OR cpe:/a:zabbix:zabbix:2.4.8:rc1:*:*:*:*:*:*

OR cpe:/a:zabbix:zabbix:2.4.9:*:*:*:*:*:*:*

OR cpe:/a:zabbix:zabbix:2.4.9:rc1:*:*:*:*:*:*

Configuration 2:

cpe:/o:debian:debian_linux:8.0:*:*:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:com.ubuntu.xenial:def:201728260000000	V	CVE-2017-2826 on Ubuntu 16.04 LTS (xenial) - medium.	2018-04-09
oval:com.ubuntu.artful:def:20172826000	V	CVE-2017-2826 on Ubuntu 17.10 (artful) - medium.	2018-04-09
oval:com.ubuntu.xenial:def:20172826000	V	CVE-2017-2826 on Ubuntu 16.04 LTS (xenial) - medium.	2018-04-09
oval:com.ubuntu.bionic:def:20172826000	V	CVE-2017-2826 on Ubuntu 18.04 LTS (bionic) - medium.	2018-04-09
oval:com.ubuntu.cosmic:def:201728260000000	V	CVE-2017-2826 on Ubuntu 18.10 (cosmic) - medium.	2018-04-09
oval:com.ubuntu.cosmic:def:20172826000	V	CVE-2017-2826 on Ubuntu 18.10 (cosmic) - medium.	2018-04-09
oval:com.ubuntu.bionic:def:201728260000000	V	CVE-2017-2826 on Ubuntu 18.04 LTS (bionic) - medium.	2018-04-09
oval:com.ubuntu.trusty:def:20172826000	V	CVE-2017-2826 on Ubuntu 14.04 LTS (trusty) - medium.	2018-04-09

BACK