PT-2013-5481 · Alienvault · Alienvault Ossim

Glafkos Charalambous · Publicado 2013-08-20 · Atualizado 2013-08-21 · CVE-2013-5321

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions AlienVault Open Source Security Information Management (OSSIM) version 4.1

Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved through various parameters in different PHP files, including the sensor parameter in a Query action to "forensics/base qry main.php", the tcp flags[] or tcp port[0][4] parameters to "forensics/base stat alerts.php", the ip addr[1][8] or port type parameters to "forensics/base stat ports.php", or the sortby or rvalue parameters in a search action to "vulnmeter/index.php".

Recommendations For AlienVault Open Source Security Information Management (OSSIM) version 4.1, consider disabling the vulnerable parameters sensor, tcp flags[], tcp port[0][4], ip addr[1][8], port type, sortby, and rvalue in their respective PHP files until a patch is available. Restrict access to the affected PHP files, such as "forensics/base qry main.php", "forensics/base stat alerts.php", "forensics/base stat ports.php", and "vulnmeter/index.php", to minimize the risk of exploitation.

Exploit

Correção

RCE

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2013-5321

Produtos afetados

Alienvault Ossim

Referências · 7

• 🔥 http://exploit-db.com/exploits/26406 · Exploit
• 🔥 https://exploit-db.com/exploits/26406 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2013-5321 · Nota de Segurança
• https://osv.dev/vulnerability/UBUNTU-CVE-2013-5321 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5321 · Nota
• https://cve.org/CVERecord?id=CVE-2013-5321 · Nota de Segurança
• https://ubuntu.com/security/CVE-2013-5321 · Aviso do Fabricante