Vulnerability Details : CVE-2023-32726
The vulnerability is caused by improper check for check if RDLENGTH does not overflow the buffer in response from DNS server.
Products affected by CVE-2023-32726
- cpe:2.3:a:zabbix:zabbix-agent:*:*:*:*:*:*:*:*
- cpe:2.3:a:zabbix:zabbix-agent:*:*:*:*:*:*:*:*
- cpe:2.3:a:zabbix:zabbix-agent:*:*:*:*:*:*:*:*
- cpe:2.3:a:zabbix:zabbix-agent:7.0.0:alpha1:*:*:*:*:*:*
- cpe:2.3:a:zabbix:zabbix-agent:7.0.0:alpha6:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2023-32726
0.70%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 70 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2023-32726
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
8.1
|
HIGH | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
2.2
|
5.9
|
NIST | |
3.9
|
LOW | CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L |
0.5
|
3.4
|
Zabbix |
CWE ids for CVE-2023-32726
-
The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.Assigned by:
- nvd@nist.gov (Primary)
- security@zabbix.com (Secondary)
References for CVE-2023-32726
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UMFKNV5E4LG2DIZNPRWQ2ENH75H6UEQT/
[SECURITY] Fedora 39 Update: zabbix-6.0.25-1.fc39 - package-announce - Fedora Mailing-Lists
-
https://support.zabbix.com/browse/ZBX-23855
[ZBX-23855] Possible buffer overread from reading DNS responses (CVE-2023-32726) - ZABBIX SUPPORTVendor Advisory
-
https://lists.debian.org/debian-lts-announce/2024/01/msg00012.html
[SECURITY] [DLA 3717-1] zabbix security update
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BYSYLA7VTHR25CBLYO5ZLEJFGU7HTHQB/
[SECURITY] Fedora 38 Update: zabbix-6.0.25-1.fc38 - package-announce - Fedora Mailing-Lists
Jump to