CVE-2009-4502

The record

The NET_TCP_LISTEN function in net.c in Zabbix Agent before 1.6.7, when running on FreeBSD or Solaris, allows remote attackers to bypass the EnableRemoteCommands setting and execute arbitrary commands via shell metacharacters in the argument to net.tcp.listen. NOTE: this attack is limited to attacks from trusted IP addresses.

Affected packages

Related vulnerabilities

• CVE-2024-36465 A low privilege (regular) Zabbix user with API access can use SQL injection vulnerability… Also affects zabbix
• CVE-2024-36464 When exporting media types, the password is exported in the YAML in plain text. Also affects zabbix
• CVE-2024-42330 The HttpRequest object allows to get the HTTP headers from the server's response after… Also affects zabbix
• CVE-2024-42333 The researcher is showing that it is possible to leak a small amount of Zabbix Server… Also affects zabbix
• CVE-2024-42332 The researcher is showing that due to the way the SNMP trap log is parsed, an attacker… Also affects zabbix
• CVE-2024-42331 In the src/libs/zbxembed/browser.c file, the es_browser_ctor method retrieves a heap… Also affects zabbix
• CVE-2024-36467 An authenticated user with API access (e.g.: user with default User role), more… Also affects zabbix
• CVE-2024-22117 When a URL is added to the map element, it is recorded in the database with sequential… Also affects zabbix