PT-2020-20145 · Trend Micro · Ossec-Hids

Published 2020-01-30 · Updated 2022-09-12 · CVE-2020-8445

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions OSSEC-HIDS versions 2.7 through 3.5.0

Description The issue arises from the OS CleanMSG function in ossec-analysisd, which fails to remove or encode terminal control characters or newlines from processed log messages. This can lead to the injection of nested events into the ossec log, as newlines are permitted in messages processed by ossec-analysisd. The use of terminal control characters may allow for the obfuscation of events or the execution of commands when viewed through vulnerable terminal emulators, potentially resulting in an unauthenticated remote attack for certain types and origins of logged data.

Recommendations For OSSEC-HIDS versions 2.7 through 3.5.0, consider disabling the OS CleanMSG function in ossec-analysisd or restricting the use of terminal control characters and newlines in log messages until a patch is available. Restrict access to the ossec log to minimize the risk of exploitation. Avoid using vulnerable terminal emulators to view log messages until the issue is resolved.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2020-8445

Affected Products

Ossec-Hids

References · 7

• https://ossec.net · Vendor Advisory
• https://security.gentoo.org/glsa/202007-33 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-8445 · Security Note
• https://osv.dev/vulnerability/CVE-2020-8445 · Vendor Advisory
• https://github.com/ossec/ossec-hids/issues/1814 · Note
• https://github.com/ossec/ossec-hids/issues/1821 · Note
• https://t.me/cvenotify/638 · Telegram Post