-
Defect (Security)
-
Resolution: Unresolved
-
Trivial
-
None
-
2.0.5
-
RHEL6
Zabbix server writes pinger instructions into /tmp/zabbix_server_$PID.pinger , then forks off fping / fping6 with option to take this as input.
It's unwise to use well-known temp filenames in a publicly controlled directory, since you can then either:
- force root to unlink a file ( by side mounting another filesystem / binding )
- get zabbix to ping the whole interenet (local DoS)
- get zabbix to ping the whole ipv6 space (local DoS)
- prevent zabbix from pinging anything ( local DoS )
Better would be to have a temp directory (mkdtemp ) if the filename needs to be predictable, or use a random temp name ( mkstemp )
alternatively: make sure that all such file-based semaphores are in a known , controlled space, /var/cache/zabbixsrv/ or other.