zoneminder - Information Disclosure and Authentication Bypass
Summary
DLA-806-1: zoneminder - security update. Affects zoneminder versions < 1.25.0-4+deb7u1. Fixed in 1.25.0-4+deb7u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ZoneMinder is a popular open-source video surveillance software package that allows users to monitor and record multiple cameras simultaneously. It provides a web-based interface for managing and viewing CCTV images. The vulnerability in ZoneMinder v1.30.0 involves an information disclosure and authentication bypass in the bundled Apache HTTP Server configuration. This allows remote unauthenticated attackers to browse all directories in the web root, potentially exposing sensitive CCTV images.
Vulnerability Detail
The vulnerability in ZoneMinder v1.30.0 allows remote unauthenticated attackers to access and view all directories in the web root, including CCTV images. By exploiting this vulnerability, an attacker can bypass authentication and gain unauthorized access to sensitive surveillance footage. This poses a significant privacy and security risk, as it allows an attacker to monitor and potentially misuse the captured video data.
How To Fix
Minimum fixed version
1.25.0-4+deb7u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade zoneminderTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to upgrade the zoneminder package to the fixed version.
Conclusion
The vulnerability in ZoneMinder v1.30.0 allows remote unauthenticated attackers to browse all directories in the web root, potentially exposing sensitive CCTV images. To mitigate this risk, it is crucial to upgrade the zoneminder package to version 1.25.0-4+deb7u1 or later. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for zoneminder →
FAQ
ZoneMinder is an open-source video surveillance software package that allows users to monitor and record multiple cameras simultaneously. It provides a web-based interface for managing and viewing CCTV images.
This vulnerability allows remote unauthenticated attackers to browse all directories in the web root, including CCTV images. It can lead to unauthorized access to sensitive surveillance footage and potential misuse of the captured video data.
To fix this vulnerability, it is recommended to upgrade the zoneminder package to version 1.25.0-4+deb7u1 or later. Follow the instructions provided in the NEWS file during the upgrade process.
There is no specific workaround mentioned for this vulnerability. The recommended solution is to upgrade the zoneminder package to the fixed version.
You can find more information about Debian LTS security advisories, how to apply updates, and frequently asked questions at the Debian LTS wiki: https://wiki.debian.org/LTS
Related vulnerabilities
Recent vulnerabilities recorded for zoneminder.
