Covered by FixVibehigh

ZXCVFIKIVIBESEG0. Fakahaa'i 'o e fakamatala 'o e fokotu'utu'u 'o e ZoneMinder 'o e Apache (CVE-2016-10140) ZXCVFIXVIBESEND ZXCVFIKVIBESEG1. ZoneMinder 1.29 mo e 1.30 'oku 'i ai ha misconfiguration 'o e Apache 'oku ne faka'ata 'a e fekumi 'i he tohi fakahinohino 'oku 'ikai fakamo'oni'i mo e malava ke fakamo'oni'i 'a e bypass. ZXCVFIXVIBESEND ZXCVFIKIVIBESEG2. 'Oku uesia 'a e ngaahi liliu 'o e ZoneMinder 1.29 mo e 1.30 'e ha fakatahataha'i 'o e Apache HTTP Server hala. 'Oku faka'ata 'e he hala ko 'eni 'a e kau 'ohofi mama'o, 'oku 'ikai ke fakamo'oni'i ke nau vakai'i 'a e uepi root directory, 'e malava ke ne taki atu ki hono fakahaa'i 'o e fakamatala mahu'inga mo e bypass 'o e fakamo'oni. ZXCVFIXVIBESEND ZXCVFIKIVIBESEG3. ## Uesia ZXCVFIXVIBESEND ZXCVFIKVIBESEG4. 'E lava ke vakai'i 'e ha mama'o, 'ikai fakamo'oni'i 'a e 'ohofi 'a e ngaahi tohi fakahinohino 'i loto 'i he aka 'o e uepi 'o ha ZoneMinder fokotu'u CVE-2016-10140. 'Oku faka'ata 'e he faka'ali'ali ko 'eni 'a e fakahaa'i 'o e fakamatala 'o e sisitemi 'oku mahu'inga pea 'e lava ke ne taki atu ki ha bypass fakamo'oni kakato, 'o foaki 'a e hū ta'efakangofua ki he interface pule'i 'o e tohi kole ZXCVFIXVIBETOKEN1ZXCV. ZXCVFIXVIBESEND ZXCVFIKVIBESEG5. ## Tupu'anga Tefito ZXCVFIXVIBESEND ZXCVFIKVIBESEG6. 'Oku fakatupu 'e he vaivai 'a e hala 'o e Apache HTTP Server 'oku fakataha'i 'aki 'a e ngaahi liliu 'o e ZoneMinder 1.29 mo e 1.30 CVE-2016-10140. 'Oku 'ikai lava 'e he configuration ke fakangatangata 'a e indexing 'o e tohi fakahinohino, 'a ia 'oku iku ki he seva 'o e uepi 'oku ne ngaue 'aki 'a e ngaahi lisi 'o e tohi fakahinohino ki he kau faka'aonga'i 'oku 'ikai ke fakamo'oni'i ZXCVFIXVIBETOKEN1ZXCV. ZXCVFIXVIBESEND ZXCVFIKVIBESEG7. ## Fakalelei'i ZXCVFIXVIBESEND ZXCVFIKIVIBESEG8. Ke fakalelei'i 'a e palopalema ko 'eni, 'Oku totonu ke fakafo'ou 'e he kau pule 'a e ZoneMinder ki ha founga 'oku kau ai ha fakatonutonu 'o e seva 'o e uepi CVE-2016-10140. Kapau 'oku 'ikai ke lava ha fakalelei'i vave, 'Oku totonu ke fakafefeka'i 'e he nima 'a e ngaahi faile configuration 'o e Apache 'oku fekau'aki mo e fokotu'u 'o e ZoneMinder ke fakata'e'aonga'i 'a e indexing 'o e tohi fakahinohino mo fakamālohi'i 'a e ngaahi pule'i 'o e hū fefeka 'i he aka 'o e uepi ZXCVFIXVIBETOKEN1ZXCV. ZXCVFIXVIBESEND ZXCVFIKVIBESEG9. ## Fakatotolo ki he Fakatotolo ZXCVFIXVIBESEND ZXCVFAKATOKANGAVIBESEG10 'Oku fakahaa'i 'e he fakatotolo ki he vaivai ko 'eni 'oku kau 'i he 'ilo'i 'a hono 'ilo'i 'o e ngaahi me'a 'oku hoko 'i he ZoneMinder mo e feinga ke hu ki he aka 'o e uepi pe ngaahi subdirectories 'iloa 'o 'ikai ha fakamo'oni CVE-2016-10140. 'Oku fakahaa'i angamaheni 'a e tu'unga faingata'a'ia 'e he 'i ai 'a e ngaahi founga lisi 'o e tohi fakahinohino angamaheni, hange ko e "Index 'o e /" 'a e aho, 'i he sino tali HTTP 'i he taimi 'oku 'ikai ha fakataha 'oku 'aonga 'oku 'i ai ZXCVFIXVIBETOKEN1ZXCV.

ZoneMinder versions 1.29 and 1.30 are affected by a bundled Apache HTTP Server misconfiguration. This flaw allows remote, unauthenticated attackers to browse the web root directory, potentially leading to sensitive information disclosure and authentication bypass.

CVE-2016-10140CWE-200

Impact

A remote, unauthenticated attacker can browse directories within the web root of a ZoneMinder installation [S1]. This exposure allows for the disclosure of sensitive system information and can lead to a complete authentication bypass, granting unauthorized access to the application's management interface [S1].

Root Cause

The vulnerability is caused by a flawed Apache HTTP Server configuration bundled with ZoneMinder versions 1.29 and 1.30 [S1]. The configuration fails to restrict directory indexing, which results in the web server serving directory listings to unauthenticated users [S1].

Remediation

To address this issue, administrators should update ZoneMinder to a version that includes a corrected web server configuration [S1]. If an immediate upgrade is not possible, the Apache configuration files associated with the ZoneMinder installation should be manually hardened to disable directory indexing and enforce strict access controls on the web root [S1].

Detection Research

Research into this vulnerability indicates that detection involves identifying ZoneMinder instances and attempting to access the web root or known subdirectories without authentication [S1]. A vulnerable state is typically indicated by the presence of standard directory listing patterns, such as the "Index of /" string, in the HTTP response body when no valid session is present [S1].