PT-2014-5703 · Alienvault · Alienvault Ossim

Publicado 2014-06-13 · Atualizado 2014-06-19 · CVE-2014-4151

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions AlienVault OSSIM versions prior to 4.8.0

Description The issue allows remote attackers to create arbitrary files and execute arbitrary code via a crafted set file request to the av-centerd SOAP service. This is due to a vulnerability in the Util.pm module.

Recommendations For versions prior to 4.8.0, update to version 4.8.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the av-centerd SOAP service to minimize the risk of exploitation. Avoid using the set file request in the affected service until the issue is resolved.

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2014-4151

ZDI-14-205

Produtos afetados

Alienvault Ossim

Referências · 6

• http://secunia.com/advisories/59112 · Nota
• https://zerodayinitiative.com/advisories/ZDI-14-205 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4151 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-4151 · Nota de Segurança
• http://zerodayinitiative.com/advisories/ZDI-14-205 · Nota
• http://forums.alienvault.com/discussion/2806 · Aviso do Fabricante