PT-2012-1938 · Splunk · Splunk

Gary Oleary-Steele · Published 2012-01-03 · Updated 2012-01-26 · CVE-2011-4644

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Splunk versions 4.2.5 and earlier

Description The issue allows remote attackers to read arbitrary files or execute management commands. This is possible when a Free license is selected, enabling potentially undesirable functionality within an environment that intentionally does not support authentication. Attackers can leverage the ability to create crafted data sources via a management-console session or send an HTTP request to execute management commands.

Recommendations For Splunk versions 4.2.5 and earlier, consider disabling the ability to create crafted data sources and restrict access to management-console sessions to minimize the risk of exploitation. Additionally, limit the execution of management commands via HTTP requests until a fix is available.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2011-4644

Affected Products

Splunk

References · 6

• 🔥 https://exploit-db.com/exploits/18245 · Exploit
• 🔥 http://sec-1.com/blog/wp-content/uploads/2011/12/Attacking_Splunk_Release.pdf · Exploit
• 🔥 http://exploit-db.com/exploits/18245 · Exploit
• 🔥 http://sec-1.com/blog/?p=233 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2011-4644 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4644 · Note