Uploaded image for project: 'ZABBIX BUGS AND ISSUES'
  1. ZABBIX BUGS AND ISSUES
  2. ZBX-6415

Unsafe tempfile handling for pingers

XMLWordPrintable

    • Icon: Defect (Security) Defect (Security)
    • Resolution: Unresolved
    • Icon: Trivial Trivial
    • None
    • 2.0.5
    • Proxy (P), Server (S)
    • RHEL6

      Zabbix server writes pinger instructions into /tmp/zabbix_server_$PID.pinger , then forks off fping / fping6 with option to take this as input.

      It's unwise to use well-known temp filenames in a publicly controlled directory, since you can then either:

      • force root to unlink a file ( by side mounting another filesystem / binding )
      • get zabbix to ping the whole interenet (local DoS)
      • get zabbix to ping the whole ipv6 space (local DoS)
      • prevent zabbix from pinging anything ( local DoS )

      Better would be to have a temp directory (mkdtemp ) if the filename needs to be predictable, or use a random temp name ( mkstemp )
      alternatively: make sure that all such file-based semaphores are in a known , controlled space, /var/cache/zabbixsrv/ or other.

            Unassigned Unassigned
            spider D.Spindel Ljungmark
            Votes:
            2 Vote for this issue
            Watchers:
            1 Start watching this issue

              Created:
              Updated: