Test ID:	1.3.6.1.4.1.25623.1.1.12.2023.5889.1
Category:	Ubuntu Local Security Checks
Title:	Ubuntu: Security Advisory (USN-5889-1)
Summary:	The remote host is missing an update for the 'zoneminder' package(s) announced via the USN-5889-1 advisory.
Description:	Summary: The remote host is missing an update for the 'zoneminder' package(s) announced via the USN-5889-1 advisory. Vulnerability Insight: It was discovered that ZoneMinder was not properly sanitizing URL parameters for certain views. An attacker could possibly use this issue to perform a cross-site scripting (XSS) attack. This issue was only fixed in Ubuntu 16.04 ESM. (CVE-2019-6777) It was discovered that ZoneMinder was not properly sanitizing stored user input later printed to the user in certain views. An attacker could possibly use this issue to perform a cross-site scripting (XSS) attack. This issue was only fixed in Ubuntu 16.04 ESM. (CVE-2019-6990, CVE-2019-6992) It was discovered that ZoneMinder was not properly limiting data size and not properly performing bound checks when processing username and password data, which could lead to a stack buffer overflow. An attacker could possibly use this issue to bypass authentication, cause a denial of service or execute arbitrary code. This issue was only fixed in Ubuntu 16.04 ESM. (CVE-2019-6991) It was discovered that ZoneMinder was not properly defining and filtering data that was appended to the webroot URL of a view. An attacker could possibly use this issue to perform cross-site scripting (XSS) attacks. This issue was only fixed in Ubuntu 16.04 ESM and Ubuntu 20.04 ESM. (CVE-2019-7325, CVE-2019-7329) It was discovered that ZoneMinder was not properly sanitizing stored user input later printed to the user in certain views. An attacker could possibly use this issue to perform a cross-site scripting (XSS) attack. This issue was only fixed in Ubuntu 20.04 ESM. (CVE-2019-7326) It was discovered that ZoneMinder was not properly sanitizing URL parameters for certain views. An attacker could possibly use this issue to perform a cross-site scripting (XSS) attack. This issue was only fixed in Ubuntu 20.04 ESM. (CVE-2019-7327, CVE-2019-7328, CVE-2019-7330, CVE-2019-7332) It was discovered that ZoneMinder was not properly sanitizing user input in the monitor editing view. An attacker could possibly use this issue to perform a cross-site scripting (XSS) attack. This issue was only fixed in Ubuntu 16.04 ESM and Ubuntu 20.04 ESM. (CVE-2019-7331) It was discovered that ZoneMinder was not properly sanitizing data related to file paths in a system. An attacker could possibly use this issue to execute arbitrary code. (CVE-2022-29806) Affected Software/OS: 'zoneminder' package(s) on Ubuntu 16.04, Ubuntu 20.04, Ubuntu 22.04. Solution: Please install the updated package(s). CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2019-6777 https://github.com/ZoneMinder/zoneminder/issues/2436 https://github.com/mnoorenberghe/ZoneMinder/commit/59cc65411f02c7e39a270fda3ecb4966d7b48d41 Common Vulnerability Exposure (CVE) ID: CVE-2019-6990 https://github.com/ZoneMinder/zoneminder/commit/a3e8fd4fd5b579865f35aac3b964bc78d5b7a94a https://github.com/ZoneMinder/zoneminder/issues/2444 Common Vulnerability Exposure (CVE) ID: CVE-2019-6991 https://github.com/ZoneMinder/zoneminder/issues/2478 https://github.com/ZoneMinder/zoneminder/pull/2482 Common Vulnerability Exposure (CVE) ID: CVE-2019-6992 https://github.com/ZoneMinder/zoneminder/commit/8c5687ca308e441742725e0aff9075779fa1a498 https://github.com/ZoneMinder/zoneminder/issues/2445 Common Vulnerability Exposure (CVE) ID: CVE-2019-7325 https://github.com/ZoneMinder/zoneminder/issues/2450 Common Vulnerability Exposure (CVE) ID: CVE-2019-7326 https://github.com/ZoneMinder/zoneminder/issues/2452 Common Vulnerability Exposure (CVE) ID: CVE-2019-7327 https://github.com/ZoneMinder/zoneminder/issues/2447 Common Vulnerability Exposure (CVE) ID: CVE-2019-7328 https://github.com/ZoneMinder/zoneminder/issues/2449 Common Vulnerability Exposure (CVE) ID: CVE-2019-7329 https://github.com/ZoneMinder/zoneminder/issues/2446 Common Vulnerability Exposure (CVE) ID: CVE-2019-7330 https://github.com/ZoneMinder/zoneminder/issues/2448 Common Vulnerability Exposure (CVE) ID: CVE-2019-7331 https://github.com/ZoneMinder/zoneminder/issues/2451 Common Vulnerability Exposure (CVE) ID: CVE-2019-7332 https://github.com/ZoneMinder/zoneminder/issues/2442 Common Vulnerability Exposure (CVE) ID: CVE-2022-29806 http://packetstormsecurity.com/files/166980/ZoneMinder-Language-Settings-Remote-Code-Execution.html https://forums.zoneminder.com/viewtopic.php?t=31638 https://github.com/ZoneMinder/zoneminder/commit/9fee64b62fbdff5bf5ece1d617f1f53c7b1967cb https://github.com/ZoneMinder/zoneminder/releases/tag/1.36.13 https://krastanoel.com/cve/2022-29806
Copyright	Copyright (C) 2023 Greenbone AG

This is only one of 146377 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.