CVE-2014-6261
HighSummary
Zenoss Core through 5 Beta 3 does not properly implement the Check For Updates feature, allowing remote attackers to execute arbitrary code by spoofing the callhome server or deploying a crafted web site visited during a login session.
Risk Assessment
Attackers can exploit this vulnerability to execute remote code, potentially leading to system takeover or data leakage.
Recommendation
It is recommended to update Zenoss Core to the latest version to mitigate this vulnerability and implement additional security measures such as monitoring network traffic.
Other vulnerabilities in Zenoss Core
See all- CVE-2014-9249High
The default configuration of Zenoss Core before version 5 allows remote attackers to read or modify database information by connecting to unspecified open ports.
- CVE-2014-6256High
Zenoss Core through 5 Beta 3 allows remote attackers to bypass intended access restrictions and place files in a directory with public read or execute access via a move action.
Original NVD description (English source)
Zenoss Core through 5 Beta 3 does not properly implement the Check For Updates feature, which allows remote attackers to execute arbitrary code by (1) spoofing the callhome server or (2) deploying a crafted web site that is visited during a login session, aka ZEN-12657.