bk99.de entertain the web since 1997

bk99.de
hß · SecurityCurated

Security holes: network monitoring tool Zabbix can leak passwords

Summary

In August 2024 Zabbix closed eight security holes in its network monitoring. The most serious was CVE-2024-22116, through which administrators with restricted rights could execute code in the context of the ping script. In addition, the frontend’s audit log displayed passwords in plain text.

Ideas

  • Monitoring systems have access to many other systems and are therefore particularly critical.
  • Even restricted admin roles can lead to a complete takeover.
  • Audit logs must not contain secrets in plain text.
  • Further holes concerned the JavaScript engine, the Windows agent installer and file access.

Insights

  • Compromising a monitoring server often opens up the entire infrastructure.
  • Logging can itself become a data leak.

Facts

  • The holes were closed in 5.0.43rc1, 6.0.31rc1, 6.4.16rc1 and 7.0.0rc3.
  • CVE-2024-22116 was rated critical despite requiring admin rights.

References

Critique

  • The fixed versions named are release candidates; whether stable versions were available remains open.

Recommendations

  • Restrict admin roles in monitoring to what is necessary and check script permissions.
  • Check your tools’ logs for passwords or tokens.

Read the original article

Search the Web Archive

hß · 2026

Palo Alto Networks: numerous security holes in Prisma Browser closed

In August 2026 Palo Alto Networks closed numerous holes, most of them in the Chromium-based enterprise browser Prisma Browser. There, memory bugs could lead to code execution; version 150.49.8.187 was fixed. Further holes affected the GlobalProtect VPN client on Android, macOS and Windows, including a privilege escalation (CVE-2026-0299).

hß · 2023

Security holes: patches protect Cisco firewalls and switches

In August 2023 Cisco closed several holes in firewalls and switches. Rated high were an SNMP hole in Firepower 4100 and 9300 through which authenticated attackers could trigger restarts, an IS-IS hole in Nexus 3000 and 9000 without authentication, and a DoS hole in NX-OS. Further medium holes affected, among others, the Application Policy Infrastructure Controller.

hß · 2023

Print management solution: security holes endanger PaperCut servers

In August 2023 PaperCut closed two high-rated holes in its print management software. Via CVE-2023-3486, attackers could upload files without logging in and fill up the hard disk; via CVE-2023-39143 they could view and modify files, and according to Horizon3 even execute code. The Windows hole required the External Device Integration function, which was active by default in PaperCut NG Commercial and MF.