CVE-2017-2824
Fixed in a distro release EPSS 26%
An exploitable code execution vulnerability exists in the trapper command functionality of Zabbix Server 2.4.X. A specially crafted set of packets can cause a command injection resulting in remote code execution. An attacker can make requests from an active Zabbix Proxy to trigger this vulnerability.
Products: Zabbix Server
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | zabbix | 1:3.0.7+dfsg-3 |
| Debian 13 | zabbix | 1:3.0.7+dfsg-3 |
| Debian 14 | zabbix | 1:3.0.7+dfsg-3 |
| Debian 8 | zabbix | 1:2.2.7+dfsg-2+deb8u3 |
| Ubuntu Pro 14.04 LTS | zabbix | 1:2.2.2+dfsg-1ubuntu1+esm1 |
| Ubuntu Pro 14.04 LTS | zabbix | 1:2.2.2+dfsg-1ubuntu1+esm4 |
| Ubuntu Pro 16.04 LTS | zabbix | 1:2.4.7+dfsg-2ubuntu2.1+esm1 |
| Ubuntu Pro 16.04 LTS | zabbix | 1:2.4.7+dfsg-2ubuntu2.1+esm3 |
| Ubuntu Pro 18.04 LTS | zabbix | 1:3.0.12+dfsg-1ubuntu0.1~esm3 |
| Ubuntu Pro 20.04 LTS | zabbix | 1:4.0.17+dfsg-1ubuntu0.1~esm1 |