CVE-2009-4502

CriticalCVSS 9.3/10Last modified Jun 16, 2026

Description

The NET_TCP_LISTEN function in net.c in Zabbix Agent before 1.6.7, when running on FreeBSD or Solaris, allows remote attackers to bypass the EnableRemoteCommands setting and execute arbitrary commands via shell metacharacters in the argument to net.tcp.listen. NOTE: this attack is limited to attacks from trusted IP addresses.

Metrics

CVSS 2.0 9.3/10AV:N/AC:M/Au:N/C:C/I:C/A:C

Weakness enumeration

CWE-264

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://secunia.com/advisories/37740Vendor Advisory
http://www.securityfocus.com/archive/1/508439
http://www.vupen.com/english/advisories/2009/3514Vendor Advisory
https://support.zabbix.com/browse/ZBX-1032Exploit
http://secunia.com/advisories/37740Vendor Advisory
http://www.securityfocus.com/archive/1/508439
http://www.vupen.com/english/advisories/2009/3514Vendor Advisory
https://support.zabbix.com/browse/ZBX-1032Exploit

Timeline

Published: Dec 31, 2009
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2009

CVE-2009-45054.3Multiple cross-site scripting (XSS) vulnerabilities in OpenCMS OAMP Comments Module 1.0.1 allow remote attackers to inject arbitrary web scr CVE-2009-450910.0The administrative web console on the TANDBERG Video Communication Server (VCS) before X4.3 uses predictable session cookies in (1) tandberg CVE-2009-45108.5The SSH service on the TANDBERG Video Communication Server (VCS) before X5.1 uses a fixed DSA key, which makes it easier for remote attacker CVE-2009-45114.0Multiple directory traversal vulnerabilities in the web administration interface on the TANDBERG Video Communication Server (VCS) before X5.CVE-2009-45125.1Directory traversal vulnerability in index.php in Oscailt 3.3, when Use Friendly URL's is disabled, allows remote attackers to include and e CVE-2009-45133.5Multiple cross-site scripting (XSS) vulnerabilities in the Workflow module 5.x before 5.x-2.4 and 6.x before 6.x-1.2, a module for Drupal, a CVE-2009-45143.5Cross-site scripting (XSS) vulnerability in the OpenSocial Shindig-Integrator module 5.x and 6.x before 6.x-2.1, a module for Drupal, allows CVE-2009-45155.0The Storm module 6.x before 6.x-1.25 for Drupal does not enforce privilege requirements for storminvoiceitem nodes, which allows remote atta CVE-2009-45164.3Cross-site scripting (XSS) vulnerability in the FAQ Ask module 5.x and 6.x before 6.x-2.0, a module for Drupal, allows remote attackers to i CVE-2009-45176.8Cross-site request forgery (CSRF) vulnerability in the FAQ Ask module 5.x and 6.x before 6.x-2.0, a module for Drupal, allows remote attacke CVE-2009-45184.3Cross-site scripting (XSS) vulnerability in the Insert Node module 5.x before 5.x-1.2 for Drupal allows remote attackers to inject arbitrary CVE-2009-451910.0Multiple unspecified vulnerabilities in Ortro before 1.3.4 have unknown impact and attack vectors.