PT-2014-3198 · Splunk · Splunk

Gerhard Muntingh · Published 2014-04-03 · Updated 2014-08-07 · CVE-2013-6771

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Splunk versions prior to 5.0.5

Description The issue allows remote attackers to execute arbitrary commands, potentially leading to remote code execution. This is due to a directory traversal vulnerability in the collect script, which can be exploited by including a .. (dot dot) in the file parameter.

Recommendations For versions prior to 5.0.5, update to version 5.0.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the collect script to minimize the risk of exploitation. Avoid using the file parameter with untrusted input in the collect script until the issue is resolved.

Fix

RCE

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2013-6771

ZDI-14-052

ZDI-14-053

Affected Products

Splunk

References · 6

• https://zerodayinitiative.com/advisories/ZDI-14-053 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-14-052 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2013-6771 · Security Note
• http://splunk.com/view/SP-CAAAH76 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6771 · Note
• http://zerodayinitiative.com/advisories/ZDI-14-052 · Note