PT-2020-20143 · Trend Micro · Ossec-Hids

Cpu · Published 2020-01-30 · Updated 2022-04-26 · CVE-2020-8443

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OSSEC-HIDS versions 2.7 through 3.5.0

Description The server component responsible for log analysis, ossec-analysisd, is susceptible to an off-by-one heap-based buffer overflow. This occurs during the cleaning of crafted syslog messages received from authenticated remote agents and delivered to the analysisd processing queue by ossec-remoted.

Recommendations For OSSEC-HIDS versions 2.7 through 3.5.0, consider disabling the ossec-analysisd component temporarily until a patch is available to prevent potential exploitation of the buffer overflow vulnerability. Restrict access to the analysisd processing queue to minimize the risk of exploitation. Avoid using crafted syslog messages in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Corruption

Weakness Enumeration

CWE-193

CWE-787

Related Identifiers

CVE-2020-8443

Affected Products

Ossec-Hids

References · 7

• 🔥 https://github.com/ossec/ossec-hids/issues/1816 · Exploit
• https://osv.dev/vulnerability/CVE-2020-8443 · Vendor Advisory
• https://ossec.net · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-8443 · Security Note
• https://security.gentoo.org/glsa/202007-33 · Vendor Advisory
• https://github.com/ossec/ossec-hids/issues/1821 · Note
• https://t.me/cvenotify/636 · Telegram Post