Zabbix SQL injection

npavlidis · **Joined:** Sun Jun 04, 2006 10:03 am **Posts:** 122

SQL injection vulnerability in popup.php in Zabbix 1.8.3 and 1.8.4, and possibly other versions before 1.8.9, allows remote attackers to execute arbitrary SQL commands via the only_hostid parameter.

https://support.zabbix.com/browse/ZBX-4385
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-4674

Solution: Upgrade to version 1.8.9 that has just come out.

mikeshinn · **Posted:** Tue Dec 13, 2011 8:38 pm

Thanks for letting everyone know. ASL, the real time rules and the free rules all protect against this attack. So if you are using any of those, and you havent disabled any of your SQL protection rules, then you are protected from this attack. With that said, we are strong proponents of defense in depth and recommend you upgrade Zabbix when you can even though you may already be protected from this attack.

npavlidis · **Joined:** Sun Jun 04, 2006 10:03 am **Posts:** 122

Thanks for the reply Mike I was 99.9% sure that ASL blocked the attack

To reveal my "agenda"... I was mostly hinting Scott to update the rpms in the atomic repository

Cheers,

Nik

biggles · **Posted:** Fri Dec 16, 2011 6:05 am

npavlidis wrote:

Thanks for the reply Mike I was 99.9% sure that ASL blocked the attack

To reveal my "agenda"... I was mostly hinting Scott to update the rpms in the atomic repository

Cheers,

Nik

+1

Zabbix SQL injection

Who is online