CVE-2016-2055
published 2016-04-13CVE-2016-2055: xymond/xymond.c in xymond in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 allow remote attackers to read arbitrary files in the configuration directory via a…
PriorityP262high7.5CVSS 3.0
AVNACLPRNUINSUCHINAN
EXPLOIT
EPSS
17.85%
96.8th percentile
xymond/xymond.c in xymond in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 allow remote attackers to read arbitrary files in the configuration directory via a "config" command.
Affected
38 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | xymon | < xymon 4.3.25-1 (bookworm) | xymon 4.3.25-1 (bookworm) |
| xymon | xymon | — | — |
| xymon | xymon | — | — |
| xymon | xymon | — | — |
| xymon | xymon | — | — |
| xymon | xymon | — | — |
| xymon | xymon | — | — |
| xymon | xymon | — | — |
| xymon | xymon | — | — |
| xymon | xymon | — | — |
| xymon | xymon | — | — |
| xymon | xymon | — | — |
| xymon | xymon | — | — |
| xymon | xymon | — | — |
| xymon | xymon | — | — |
| xymon | xymon | — | — |
| xymon | xymon | — | — |
| xymon | xymon | — | — |
| xymon | xymon | — | — |
| xymon | xymon | — | — |
| xymon | xymon | — | — |
| xymon | xymon | — | — |
| xymon | xymon | — | — |
| xymon | xymon | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor network traffic to the Xymon daemon for use of the 'config' command, especially requests targeting sensitive files such as 'xymonpasswd' in the configuration directory. ↗
- →Detect exploitation attempts by monitoring for retrieval of the xymonpasswd config file, which exposes usernames and password hashes. ↗
- →Flag Xymon servers configured with ALLOWALLCONFIGFILES enabled, as this broadens the attack surface beyond CVE-2016-2055 to all config files. ↗
- ·Xymon servers with ALLOWALLCONFIGFILES enabled are vulnerable regardless of version, as this setting permits arbitrary config file downloads even on patched versions. ↗
- ·All Xymon versions 4.1.x, 4.2.x, and 4.3.x before 4.3.25 are affected; the fix is present in version 4.3.25-1 (Debian packages). ↗
CVSS provenance
nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
osv7.5HIGH
vendor_debian7.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-qfw8-j8v2-95qr: xymond/xymond
ghsa_unreviewed·2022-05-14
CVE-2016-2055 [HIGH] CWE-200 GHSA-qfw8-j8v2-95qr: xymond/xymond
xymond/xymond.c in xymond in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 allow remote attackers to read arbitrary files in the configuration directory via a "config" command.
OSV
CVE-2016-2055: xymond/xymond
osv·2016-04-13·CVSS 7.5
CVE-2016-2055 [HIGH] CVE-2016-2055: xymond/xymond
xymond/xymond.c in xymond in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 allow remote attackers to read arbitrary files in the configuration directory via a "config" command.
Debian
CVE-2016-2055: xymon - xymond/xymond.c in xymond in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 allow r...
vendor_debian·2016·CVSS 7.5
CVE-2016-2055 [HIGH] CVE-2016-2055: xymon - xymond/xymond.c in xymond in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 allow r...
xymond/xymond.c in xymond in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 allow remote attackers to read arbitrary files in the configuration directory via a "config" command.
Scope: local
bookworm: resolved (fixed in 4.3.25-1)
bullseye: resolved (fixed in 4.3.25-1)
forky: resolved (fixed in 4.3.25-1)
sid: resolved (fixed in 4.3.25-1)
trixie: resolved (fixed in 4.3.25-1)
No detection rules found.
Exploit-DB
ZeroLogon - Netlogon Elevation of Privilege
exploitdb·2020-11-18·CVSS 5.5
CVE-2020-1472 [MEDIUM] ZeroLogon - Netlogon Elevation of Privilege
ZeroLogon - Netlogon Elevation of Privilege
---
# Exploit Title: ZeroLogon - Netlogon Elevation of Privilege
# Date: 2020-10-04
# Exploit Author: West Shepherd
# Vendor Homepage: https://www.microsoft.com
# Version: Microsoft Windows Server 2019, Windows Server 2016, Windows Server 2012 R2, Windows Server 2012, Windows Server 2008 R2
# Tested on: Microsoft Windows Server 2016 Standard x64
# CVE : CVE-2020-1472
# Credit to: Tom Tervoort for discovery and Dirk-Janm for Impacket code
# Sources: https://www.secura.com/pathtoimg.php?id=2055
# Requirements: python3 and impacket 0.9.21+ (tested using this version)
#!/usr/bin/env python3
import hmac, hashlib, struct, sys, socket, time, argparse, logging, codecs
from binascii import hexlify, unhexlify
from subprocess import check_call
from impack
Metasploit
Xymon Daemon Gather Information
metasploit·CVSS 7.5
CVE-2016-2055 [HIGH] Xymon Daemon Gather Information
Xymon Daemon Gather Information
This module retrieves information from a Xymon daemon service (formerly Hobbit, based on Big Brother), including server configuration information, a list of monitored hosts, and associated client log for each host. This module also retrieves usernames and password hashes from the `xymonpasswd` config file from Xymon servers before 4.3.25, which permit download arbitrary config files (CVE-2016-2055), and servers configured with `ALLOWALLCONFIGFILES` enabled.
No writeups or analysis indexed.
http://packetstormsecurity.com/files/135758/Xymon-4.3.x-Buffer-Overflow-Code-Execution-Information-Disclosure.htmlhttp://www.debian.org/security/2016/dsa-3495http://www.securityfocus.com/archive/1/537522/100/0/threadedhttps://sourceforge.net/p/xymon/code/7890/http://packetstormsecurity.com/files/135758/Xymon-4.3.x-Buffer-Overflow-Code-Execution-Information-Disclosure.htmlhttp://www.debian.org/security/2016/dsa-3495http://www.securityfocus.com/archive/1/537522/100/0/threadedhttps://sourceforge.net/p/xymon/code/7890/
2016-04-13
Published