PT-2009-6494 · Alienvault · Alienvault Ossim

Nahuel Grisolía · Publicado 2009-12-21 · Atualizado 2017-08-17 · CVE-2009-4372

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions AlienVault Open Source Security Information Management (OSSIM) versions prior to 2.1.5-4

Description The issue allows remote attackers to execute arbitrary commands via shell metacharacters in the uniqueid parameter to API endpoints such as "wcl.php", "storage graphs.php", "storage graphs2.php", "storage graphs3.php", and "storage graphs4.php" in the sem/ directory.

Recommendations For AlienVault Open Source Security Information Management (OSSIM) versions prior to 2.1.5-4, consider updating to version 2.1.5-4 or later to resolve the issue. As a temporary workaround, restrict access to the vulnerable API endpoints in the sem/ directory to minimize the risk of exploitation. Avoid using the uniqueid parameter in the affected API endpoints until the issue is resolved.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2009-4372

Produtos afetados

Alienvault Ossim

Referências · 14

• 🔥 http://cybsec.com/vuln/OSSIM_2_1_5_Remote_Command_Execution.pdf · Exploit
• 🔥 http://exploit-db.com/exploits/10480 · Exploit
• 🔥 https://exploit-db.com/exploits/10480 · Exploit
• 🔥 http://securityfocus.com/bid/37375 · Exploit
• 🔥 http://alienvault.com/community.php?section=News · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-4372 · Nota de Segurança
• http://osvdb.org/61153 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/54843 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4372 · Nota
• http://osvdb.org/61151 · Nota
• http://osvdb.org/61155 · Nota
• http://osvdb.org/61154 · Nota
• http://secunia.com/advisories/37727 · Aviso do Fabricante
• http://osvdb.org/61152 · Nota