CVE-2009-4502 Command injection in n/a

Critical 9.3 Published 31 Dec 2009 Updated 17 Sep 2024

Remote attackers from trusted IPs can bypass security settings to execute arbitrary commands on Zabbix Agent via shell metacharacters.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2009-4502?

CVE-2009-4502 is a critical command injection vulnerability in Zabbix Zabbix, published on 31 Dec 2009. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The NET_TCP_LISTEN function in net.c in Zabbix Agent before 1.6.7, when running on FreeBSD or Solaris, allows remote attackers to bypass the EnableRemoteCommands setting and execute arbitrary commands via shell metacharacters in the argument to net.tcp.listen. NOTE: this attack is limited to attacks from trusted IP addresses.

Weakness: CWE-264

Which versions are affected by CVE-2009-4502?

It affects 1 product.

Products include Zabbix Zabbix.

How do I fix CVE-2009-4502?

Upgrade to a fixed version.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2009-4502 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2009-4502 exists.

Public exploit code: 1 Metasploit module and 2 Exploit-DB entries.

All Zabbix Zabbix vulnerabilities

Sources

Also known as DEBIAN-CVE-2009-4502, GHSA-v6qg-5p9x-9hh9.