PT-2023-9080 · Wazuh · Wazuh Manager

D0Ntrash · Publicado 2023-11-28 · Atualizado 2025-01-09 · CVE-2024-32038

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Wazuh Manager versions 3.8.0 through 4.7.1

Description The issue is related to a buffer overflow hazard in the wazuh-analysisd service when handling Unicode characters from Windows Eventchannel messages. This can be exploited by a remote attacker to execute arbitrary code. The vulnerability is associated with the incorrect handling of XML files containing Unicode characters by the cJSON PrintUnformatted() function.

Recommendations For Wazuh Manager versions 3.8.0 through 4.7.1, update to Wazuh Manager 4.7.2 to resolve the issue. As a temporary workaround, consider restricting the handling of Unicode characters from Windows Eventchannel messages in the wazuh-analysisd service until a patch is applied.

Exploit

Correção

Heap Based Buffer Overflow

Memory Corruption

Enumeração de Fraquezas

CWE-122

CWE-787

Identificadores relacionados

BDU:2024-03461

CVE-2024-32038

GHSA-FCPW-V3PG-C327

ZDI-24-397

Produtos afetados

Wazuh Manager

Referências · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/32xxx/CVE-2024-32038.json · Exploit
• https://github.com/wazuh/wazuh/security/advisories/GHSA-fcpw-v3pg-c327 · Aviso do Fabricante
• https://github.com/wazuh/wazuh/issues/20657 · Nota
• https://github.com/wazuh/wazuh/pull/20658 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-32038 · Nota
• https://safe-surf.ru/specialists/bulletins-nkcki/707406 · Nota de Segurança
• https://bdu.fstec.ru/vul/2024-03461 · Nota de Segurança
• https://zerodayinitiative.com/advisories/ZDI-24-397 · Nota de Segurança
• https://documentation.wazuh.com/current/release-notes/release-4-7-2.html · Nota
• https://t.me/cvenotify/106958 · Publicação no Telegram
• https://t.me/cvenotify/77450 · Publicação no Telegram
• https://vuldb.com/ru/?id.261617 · Nota
• https://osv.dev/vulnerability/CVE-2024-32038 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2024-32038 · Nota de Segurança
• https://t.me/cvenotify/77470 · Publicação no Telegram