PT-2014-5512 · At&T Cybersecurity · Alienvault Ossim

James Fitts

·

Publicado

2014-06-11

·

Atualizado

2017-09-16

·

CVE-2014-3804

CVSS v2.0

10

Alta

VetorAV:N/AC:L/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions AlienVault OSSIM versions prior to 4.7.0
Description The issue allows remote attackers to execute arbitrary commands via crafted requests to specific API endpoints, including update system info debian package, ossec task, set ossim setup admin ip, sync rserver, and set ossim setup framework ip. This is a remote code execution issue.
Recommendations For versions prior to 4.7.0, update to version 4.7.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable API endpoints until a patch is available. Avoid using the vulnerable functions update system info debian package, ossec task, set ossim setup admin ip, sync rserver, and set ossim setup framework ip in the affected AlienVault OSSIM versions until the issue is resolved.

Exploit

Correção

RCE

Code Injection

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2014-3804
ZDI-14-196
ZDI-14-197
ZDI-14-200
ZDI-14-201
ZDI-14-202
ZDI-14-203

Produtos afetados

Alienvault Ossim