Bug 396495 – <net-analyzer/zabbix-1.8.10-r1: Persistent Cross Site Scripting Vulnerabilities (CVE-2011-5027)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Tomasz Sałaciński 2011-12-30 07:14:55 UTC]

These URL's are vulnerable to persistent XSS attacks due to improper sanitation of gname variable when creating user and host groups.

URL:
hostgroups.php
usergrps.php

Vulnerable parameter:
gname

Method:
POST

Injected:
"</options><script>alert('XSS')</script>

Persists in:
http://test/zabbix/hostgroups.php
http://test/zabbix/users.php
http://test/zabbix/hosts.php?form=update&hostid=N (where N is a valid hostid)
http://test/zabbix/scripts.php?form=1&scriptid=N (where N is a valid scriptid)
http://test/zabbix/maintenance.php

Reproducible: Didn't try

[Comment 1 Tomasz Sałaciński 2011-12-30 07:23:32 UTC]

Solution: upgrade to 1.8.10

[Comment 2 Agostino Sarubbo 2011-12-30 07:27:32 UTC]

Sorry Tomasz, there is not an ebuild in tree and there is not A

[Comment 3 Agostino Sarubbo 2011-12-30 07:29:12 UTC]

@{patrick,matt} we stabilize here, and make the precedent security bug as stable blocked.

[Comment 4 Lars Wendler (Polynomial-C) (RETIRED) 2011-12-30 08:27:35 UTC]

+*zabbix-1.8.10 (30 Dec 2011)
+
+  30 Dec 2011; Lars Wendler <[e-mail]>
+  -zabbix-1.8.10_rc1.ebuild, +zabbix-1.8.10.ebuild:
+  non-maintainer commit: Version bump (with kind permission from bonsaikitten).
+  Removed old. This fixes bug #395975 and should help solving bug #396495.
+

[Comment 5 Tim Sammut (RETIRED) 2011-12-31 23:52:12 UTC]

Thanks, Lars. Can we move forward to stabilize =net-analyzer/zabbix-1.8.10-r1?

[Comment 6 Matthew Marlowe (RETIRED) 2012-01-01 03:44:48 UTC]

I've briefly reviewed the two non-maintainer commits made in the last 24hrs - the first commit to fix for 1.8.10 and patch handling, and the 2nd to update init scripts to reflect recent syntax changes.  Both changes seem to be correct to me after my review  (the first I went over in detail last night, the 2nd I just glanced at this evening).  I haven't had time yet to test the init script changes in the 2nd commit, but I assume the commiter did test. In that case, since 1.8.10 includes important security changes, stabilizing would likely be warranted -- I'd recommend we wait 24hrs to see if any new bugs are opened relating to either commit before marking stable though.

[Comment 7 GLSAMaker/CVETool Bot 2012-01-02 18:58:36 UTC]

CVE-2011-5027 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-5027):
  Cross-site scripting (XSS) vulnerability in ZABBIX before 1.8.10 allows
  remote attackers to inject arbitrary web script or HTML via unspecified
  vectors related to the profiler.

[Comment 8 Tim Sammut (RETIRED) 2012-01-03 15:44:09 UTC]

(In reply to comment #6)
> I'd recommend we wait 24hrs to see if any new bugs are opened
> relating to either commit before marking stable though.

Shall we go? Thanks.

[Comment 9 Matthew Marlowe (RETIRED) 2012-01-03 22:20:43 UTC]

Yes - we're a go for 1.8.10-r1 - I'm not aware of any new bugs for it despite being in tree for a few days and it should resolve several known vulnerabilities. Let's put it out there.

[Comment 10 Tim Sammut (RETIRED) 2012-01-03 22:28:34 UTC]

Great, thank you.

Arches, please test and mark stable:
=net-analyzer/zabbix-1.8.10-r1
Target keywords : "amd64 x86"

[Comment 11 Agostino Sarubbo 2012-01-04 17:58:17 UTC]

amd64 stable

[Comment 12 Paweł Hajdan, Jr. (RETIRED) 2012-01-08 19:52:11 UTC]

x86 stable

[Comment 13 Tim Sammut (RETIRED) 2012-01-08 19:56:09 UTC]

Thanks, folks. Closing noglsa for XSS.