PT-2022-10326 · Splunk · Splunk Enterprise

Sharon Brizinov + 1 · Published 2022-03-25 · Updated 2022-04-11 · CVE-2021-3422

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 7.3.9 Splunk Enterprise versions 8.0 prior to 8.0.9 Splunk Enterprise versions 8.1 prior to 8.1.3

Description The issue is related to the lack of validation of a key-value field in the Splunk-to-Splunk protocol, resulting in a denial-of-service in Splunk Enterprise instances configured to index Universal Forwarder traffic. It does not impact Universal Forwarders. When Splunk forwarding is secured using TLS or a Token, the attack requires compromising the certificate or token, or both. Implementation of either or both reduces the severity to Medium.

Recommendations For versions prior to 7.3.9, update to version 7.3.9 or later. For versions 8.0 prior to 8.0.9, update to version 8.0.9 or later. For versions 8.1 prior to 8.1.3, update to version 8.1.3 or later. As a partial mitigation and a security best practice, consider securing Splunk forwarding using TLS or a Token to reduce the severity to Medium.

Fix

DoS

RCE

Out of bounds Read

Weakness Enumeration

CWE-20

CWE-125

Related Identifiers

CVE-2021-3422

Affected Products

Splunk Enterprise

References · 5

• https://osv.dev/vulnerability/CVE-2021-3422 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-3422 · Security Note
• https://splunk.com/en_us/product-security/announcements/svd-2022-0301.html · Vendor Advisory
• https://claroty.com/2022/03/24/blog-research-locking-down-splunk-enterprise-indexers-and-forwarders · Note
• https://t.me/cibsecurity/39553 · Telegram Post