PT-2014-5512 · At&T Cybersecurity · Alienvault Ossim

James Fitts

·

Published

2014-06-11

·

Updated

2017-09-16

·

CVE-2014-3804

CVSS v2.0

10

High

VectorAV:N/AC:L/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions AlienVault OSSIM versions prior to 4.7.0
Description The issue allows remote attackers to execute arbitrary commands via crafted requests to specific API endpoints, including update system info debian package, ossec task, set ossim setup admin ip, sync rserver, and set ossim setup framework ip. This is a remote code execution issue.
Recommendations For versions prior to 4.7.0, update to version 4.7.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable API endpoints until a patch is available. Avoid using the vulnerable functions update system info debian package, ossec task, set ossim setup admin ip, sync rserver, and set ossim setup framework ip in the affected AlienVault OSSIM versions until the issue is resolved.

Exploit

Fix

RCE

Code Injection

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2014-3804
ZDI-14-196
ZDI-14-197
ZDI-14-200
ZDI-14-201
ZDI-14-202
ZDI-14-203

Affected Products

Alienvault Ossim