At&T Cybersecurity · Alienvault Ossim · CVE-2014-3804
**Name of the Vulnerable Software and Affected Versions**
AlienVault OSSIM versions prior to 4.7.0
**Description**
The issue allows remote attackers to execute arbitrary commands via crafted requests to specific API endpoints, including `update system info debian package`, `ossec task`, `set ossim setup admin ip`, `sync rserver`, and `set ossim setup framework ip`. This is a remote code execution issue.
**Recommendations**
For versions prior to 4.7.0, update to version 4.7.0 or later to resolve the issue.
As a temporary workaround, consider restricting access to the vulnerable API endpoints until a patch is available.
Avoid using the vulnerable functions `update system info debian package`, `ossec task`, `set ossim setup admin ip`, `sync rserver`, and `set ossim setup framework ip` in the affected AlienVault OSSIM versions until the issue is resolved.