CVE-2024-36468

What it actually does

Stack buffer overflow in zbx_snmp_cache_handle_engineid when copying session->securityEngineID to local_record.engineid without bounds checking, allowing memory corruption on the stack.

Why it matters to the business

Attackers could crash Zabbix server or proxy processes or potentially execute arbitrary code, disrupting centralized monitoring and alerting for IT infrastructure across the organization.

How an attack unfolds

An attacker sends a crafted SNMP response containing an oversized securityEngineID value that reaches the vulnerable function during cache handling; the missing bounds check leads to stack overwrite that can be leveraged for code execution or denial of service.

How to fix it

Upgrade Zabbix to the commit d93ce022627d3f10608b774e322cde3c961453e3 or apply the equivalent patch that adds proper bounds checking on the engineid copy.

How to confirm the fix worked

Confirm the source tree contains commit d93ce022627d3f10608b774e322cde3c961453e3, rebuild, and verify the function now performs length checks before the memcpy or equivalent copy operation.

Typical attack path

1. Craft and send malicious SNMP packet with oversized securityEngineID to Zabbix server or proxy
2. Trigger SNMP cache handling path that calls zbx_snmp_cache_handle_engineid
3. Overflow stack buffer due to unchecked copy
4. Overwrite return address or adjacent structures to achieve code execution or crash

How to detect it

Review Zabbix server and proxy logs for SNMP engineID handling errors, unexpected crashes, or high-volume SNMP traffic from untrusted sources; correlate with process dumps showing stack corruption around the vulnerable function.

What your security team should do

• Apply the fixed commit immediately on all Zabbix server and proxy instances
• Restrict SNMP access to trusted sources only
• Monitor Zabbix process stability and SNMP-related logs for anomalies