Page MenuHomeVyOS Platform

zabbix-agent affected by CVE-2023-32728 (RCE via S.M.A.R.T. plugin)
Closed, ResolvedPublicBUG

Description

Dear VyOS Maintainers,

Problem

The installed zabbix agent 2 is 6.0.14 which is affected by a RCE via it's S.M.A.R.T. plugin.
https://security-tracker.debian.org/tracker/CVE-2023-32728

Solution

Update the included zabbix agent 2 to a newer version (at least 6.0.24 which includes the fix, preferably the newest 6.0.x)

Workaround

Remove zabbix-agent until issue has been fixed in upstream or at least add a comment in the documentation that zabbix-agent is vulnerable and should not be used when lateral movement/privilege escalation from a zabbix admin to the firewall is a risk.

Best Regards

Details

Version
1.5-rolling-202409250007
Is it a breaking change?
Perfectly compatible
Issue type
Security vulnerability
Forum thread
https://forum.vyos.io/t/zabbix-agent-updates/14468

Event Timeline

syncer triaged this task as High priority.
Viacheslav changed the task status from Open to Needs testing.Oct 18 2024, 2:59 PM
Viacheslav subscribed.

Should be fixed in the next rolling release

Is the binary file data/live-build-config/archives/zabbix-official-repo.key.chroot correct? Other key files there are text files.

GPG reads the file properly, it's just that it looks a bit odd to have a binary file in a directory with otherwise text files, and the packets (keys, signatures) in that file are actually a subset of the original https://repo.zabbix.com/zabbix-official-repo.key which uses the text (ASCII armor) format.

dmbaturin edited projects, added VyOS 1.4 Sagitta (1.4.1), VyOS 1.5 Circinus; removed Bugs.
dmbaturin changed Is it a breaking change? from Unspecified (possibly destroys the router) to Perfectly compatible.
dmbaturin moved this task from Backlog to Finished on the VyOS 1.4 Sagitta (1.4.1) board.
dmbaturin moved this task from Open to Finished on the VyOS 1.5 Circinus board.