Vulnerability Details : CVE-2016-4338
The mysql user parameter configuration script (userparameter_mysql.conf) in the agent in Zabbix before 2.0.18, 2.2.x before 2.2.13, and 3.0.x before 3.0.3, when used with a shell other than bash, allows context-dependent attackers to execute arbitrary code or SQL commands via the mysql.size parameter.
Vulnerability category: Sql InjectionExecute code
Products affected by CVE-2016-4338
- cpe:2.3:a:zabbix:zabbix:2.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:zabbix:zabbix:2.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:zabbix:zabbix:2.0.6:*:*:*:*:*:*:*
- cpe:2.3:a:zabbix:zabbix:2.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:zabbix:zabbix:2.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:zabbix:zabbix:2.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:zabbix:zabbix:2.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:zabbix:zabbix:2.2.1:-:*:*:*:*:*:*
- cpe:2.3:a:zabbix:zabbix:2.2.0:-:*:*:*:*:*:*
- cpe:2.3:a:zabbix:zabbix:2.0.7:*:*:*:*:*:*:*
- cpe:2.3:a:zabbix:zabbix:2.0.12:*:*:*:*:*:*:*
- cpe:2.3:a:zabbix:zabbix:2.0.8:*:*:*:*:*:*:*
- cpe:2.3:a:zabbix:zabbix:2.0.9:*:*:*:*:*:*:*
- cpe:2.3:a:zabbix:zabbix:2.0.10:*:*:*:*:*:*:*
- cpe:2.3:a:zabbix:zabbix:2.0.11:*:*:*:*:*:*:*
- cpe:2.3:a:zabbix:zabbix:2.2.4:*:*:*:*:*:*:*
- cpe:2.3:a:zabbix:zabbix:2.0.13:*:*:*:*:*:*:*
- cpe:2.3:a:zabbix:zabbix:2.2.6:*:*:*:*:*:*:*
- cpe:2.3:a:zabbix:zabbix:2.2.5:*:*:*:*:*:*:*
- cpe:2.3:a:zabbix:zabbix:2.2.7:*:*:*:*:*:*:*
- cpe:2.3:a:zabbix:zabbix:3.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:zabbix:zabbix:3.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:zabbix:zabbix:2.0.14:*:*:*:*:*:*:*
- cpe:2.3:a:zabbix:zabbix:2.2.10:*:*:*:*:*:*:*
- cpe:2.3:a:zabbix:zabbix:2.2.9:*:*:*:*:*:*:*
- cpe:2.3:a:zabbix:zabbix:2.2.8:*:*:*:*:*:*:*
- cpe:2.3:a:zabbix:zabbix:2.2.2:-:*:*:*:*:*:*
- cpe:2.3:a:zabbix:zabbix:2.0.17:*:*:*:*:*:*:*
- cpe:2.3:a:zabbix:zabbix:2.0.16:*:*:*:*:*:*:*
- cpe:2.3:a:zabbix:zabbix:2.0.15:*:*:*:*:*:*:*
- cpe:2.3:a:zabbix:zabbix:2.2.12:*:*:*:*:*:*:*
- cpe:2.3:a:zabbix:zabbix:2.2.11:*:*:*:*:*:*:*
- cpe:2.3:a:zabbix:zabbix:2.2.3:-:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2016-4338
2.12%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 88 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2016-4338
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
6.8
|
MEDIUM | AV:N/AC:M/Au:N/C:P/I:P/A:P |
8.6
|
6.4
|
NIST | |
8.1
|
HIGH | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
2.2
|
5.9
|
NIST |
CWE ids for CVE-2016-4338
-
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.Assigned by: nvd@nist.gov (Primary)
References for CVE-2016-4338
-
https://www.zabbix.com/documentation/3.0/manual/introduction/whatsnew303#miscellaneous_improvements
8 What's new in Zabbix 3.0.3 [Zabbix Documentation 3.0]Vendor Advisory
-
http://www.securityfocus.com/archive/1/538258/100/0/threaded
SecurityFocus
-
https://support.zabbix.com/browse/ZBX-10741
[ZBX-10741] included to sources user param mysql.size[] produces error on some shells - ZABBIX SUPPORTExploit;Patch;Vendor Advisory
-
https://www.zabbix.com/documentation/2.2/manual/introduction/whatsnew2213#miscellaneous_improvements
18 What's new in Zabbix 2.2.13 [Zabbix Documentation 2.2]Vendor Advisory
-
http://www.securityfocus.com/bid/89631
Zabbix CVE-2016-4338 Command Injection VulnerabilityThird Party Advisory;VDB Entry
-
http://seclists.org/fulldisclosure/2016/May/9
Full Disclosure: CVE-2016-4338: Zabbix Agent 3.0.1 mysql.size shell command injectionExploit;Third Party Advisory;VDB Entry
-
http://packetstormsecurity.com/files/136898/Zabbix-Agent-3.0.1-mysql.size-Shell-Command-Injection.html
Zabbix Agent 3.0.1 mysql.size Shell Command Injection ≈ Packet StormExploit;Third Party Advisory;VDB Entry
-
https://www.zabbix.com/documentation/2.0/manual/introduction/whatsnew2018#miscellaneous_improvements
22.4 Frontend improvements [Zabbix Documentation 2.0]Vendor Advisory
-
https://security.gentoo.org/glsa/201612-42
Zabbix: Multiple vulnerabilities (GLSA 201612-42) — Gentoo securityThird Party Advisory;VDB Entry
-
https://www.exploit-db.com/exploits/39769/
Zabbix Agent 3.0.1 - 'mysql.size' Shell Command InjectionExploit;Third Party Advisory;VDB Entry
Jump to