Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 450742 (CVE-2012-6086) - <net-analyzer/zabbix-2.0.8: Improper use of cURL API might lead to improper SSL certificate verification (MiTM) (CVE-2012-6086)
Summary: <net-analyzer/zabbix-2.0.8: Improper use of cURL API might lead to improper S...
Status: RESOLVED FIXED
Alias: CVE-2012-6086
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
URL: https://bugzilla.redhat.com/show_bug....
Whiteboard: B3 [noglsa]
Keywords:
Depends on:
Blocks:
 
Reported: 2013-01-07 19:19 UTC by Agostino Sarubbo
Modified: 2014-02-13 15:26 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Agostino Sarubbo gentoo-dev 2013-01-07 19:19:41 UTC 
From $URL :

A security flaw was found in the way Zabbix, an open-source monitoring solution for IT 
infrastructure, used (lib)cURL's CURLOPT_SSL_VERIFYHOST variable, when doing certificate validation 
(value of '1' meaning only check for the existence of a common name was used instead of value '2' - 
which also checks if the particular common name matches the requested hostname of the server). A 
rogue service could use this flaw to conduct man-in-the-middle (MiTM) attacks.

Upstream bug report:
[1] https://support.zabbix.com/browse/ZBX-5924

References:
[2] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=697443
[3] http://www.openwall.com/lists/oss-security/2013/01/02/1
[4] http://www.openwall.com/lists/oss-security/2013/01/03/1
Comment 1 Matthew Marlowe (RETIRED) gentoo-dev 2013-02-11 01:58:22 UTC 
I've commented on the upstream bug report and hopefully they'll have this fixed soon.  Have to wait on them.
Comment 2 Matthew Marlowe (RETIRED) gentoo-dev 2013-06-22 02:46:26 UTC 
Commented on upstream bug again, if no response soon will update ebuild to require earlier versions of curl.
Comment 3 Matthew Marlowe (RETIRED) gentoo-dev 2013-06-23 05:28:09 UTC 
zabbix-2.0.6-r5 which was just committed to cvs places restrictions on curl version dependencies, this will be a stopgap measure until upstream fixes ZBX-5924.
Comment 4 Alice Ferrazzi Gentoo Infrastructure gentoo-dev 2013-08-28 13:49:32 UTC 
resolved in version 2.0.8 [https://support.zabbix.com/browse/ZBX-5924]
Comment 5 Matthew Marlowe (RETIRED) gentoo-dev 2013-10-04 22:05:20 UTC 
All zabbix versions prior to 2.0.8 have been removed.  Curl issues should be resolved. Closing.
Comment 6 Chris Reffett (RETIRED) gentoo-dev Security 2013-10-04 22:10:58 UTC 
GLSA vote: no.
Comment 7 Sergey Popov gentoo-dev 2013-10-05 21:04:51 UTC 
GLSA vote: no

Closing as noglsa
Comment 8 GLSAMaker/CVETool Bot gentoo-dev 2014-02-13 15:26:08 UTC 
CVE-2012-6086 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-6086):
  libs/zbxmedia/eztexting.c in Zabbix 1.8.x before 1.8.18rc1, 2.0.x before
  2.0.8rc1, and 2.1.x before 2.1.2 does not properly set the
  CURLOPT_SSL_VERIFYHOST option for libcurl, which allows man-in-the-middle
  attackers to spoof SSL servers via an arbitrary valid certificate.