PT-2019-13725 · Sphinx Technologies+1 · Sphinx+1

Publicado 2019-06-02 · Atualizado 2022-04-01 · CVE-2019-14511

Positive Technologies (AI Summary)

CVSS v2.0

9.4

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions Sphinx Technologies Sphinx version 3.1.1

Description The issue is related to the default configuration of Sphinx, which lacks authentication and listens on 0.0.0.0, making it exposed to the internet unless filtered by a firewall or reconfigured to listen to 127.0.0.1 only.

Recommendations For version 3.1.1, reconfigure Sphinx to listen on 127.0.0.1 only or ensure it is filtered by a firewall to minimize exposure. Consider implementing authentication to secure the service.

Exploit

Correção

Missing Authentication

Enumeração de Fraquezas

CWE-306

CWE-21

Identificadores relacionados

BDU:2022-00467

CVE-2019-14511

DLA-2882-1

DSA-5036-1

MGASA-2020-0087

OPENSUSE-SU-2022_0046-1

OPENSUSE-SU-2022_0054-1

Produtos afetados

Sphinx

Suse

Referências · 30

• 🔥 https://blog.wirhabenstil.de/2019/08/19/sphinxsearch-0-0-0-09306-cve-2019-14511 · Exploit
• https://github.com/manticoresoftware/manticoresearch/commit/66b5761ad258c60b1866a8e1333f86e74f48035 · Nota
• https://github.com/manticoresoftware/manticoresearch/commit/6e597ff61e1e910559f6ed541ff32520085af6aa · Nota
• https://github.com/manticoresoftware/manticoresearch/issues/261 · Nota
• https://github.com/manticoresoftware/manticoresearch/commit/023c9b2acb24db5e9c6d8052afa68660aeee8d3e · Nota
• https://security-tracker.debian.org/tracker/CVE-2019-14511 · Aviso do Fabricante
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/YSLPW44RWIGHU5AG3P4U2HPSD3UBG4GJ · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2019-14511 · Aviso do Fabricante
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3FPPNZZMWTZOMFGFETMET6YKIH2DQDKS · Aviso do Fabricante
• https://advisories.mageia.org/MGASA-2020-0087.html · Nota de Segurança
• https://salsa.debian.org/debian/sphinxsearch/-/blob/4d6fe40644130308604845db43d3588e715ec85d/debian/patches/06-CVE-2020-29050.patch · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-29050 · Nota
• https://cve.org/CVERecord?id=CVE-2019-14511 · Nota de Segurança
• http://sphinxsearch.com/docs/sphinx3.html#getting-started-on-linux-and-macos · Aviso do Fabricante
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XD25JJJVM7FFXAO2L3ZG2KXQ6UMFBIA4 · Aviso do Fabricante