Getting Data In

Does CVE-2013-6771 require upgrading to minimum 5.0.5?

the_wolverine
Champion

The following vuln, CVE-2013-6771, appears to only be fixed in 5.0.5 and newer:

http://www.splunk.com/view/SP-CAAAH76

Does this mean there will be no fix for 4.x forwarders and I will need to upgrade thousands of forwarders to version 5.0.5 at minimum?

1 Solution

the_wolverine
Champion

Just confirmed with Splunk that this vulnerability applies to all instances, including forwarders.

You will need to contact support for solutions.

View solution in original post

jrodman
Splunk Employee
Splunk Employee

The vulnerability is a privilege escalation via a search mechanism. You can mitigate the problem by making it impossible for users to run searches on your forwarders, for example by not providing access to the management port, or by avoiding having accounts on those forwarders that anyone has the credentials for, or by not providing the search capability to any users who do exist on those systems, or a combination of any of the above.

Of of course as jbacking points out, by running UFs where executing search is not permitted at all.

jrodman
Splunk Employee
Splunk Employee

As Our Wolverine intimates, there are tradeoffs between specificity and not. I tried to provide enough information to give mitigation information without giving steps to cause trouble. I'll relay this question along internally. It's possible I may be chided for saying more than is desirable. We'll see.

0 Karma

lukejadamec
Super Champion

Hence the stupid question preface, put a cork in it.

0 Karma

the_wolverine
Champion

@lukejadamec, posting specifics of such a vuln would potentially give free information away to someone with malicious intent.

0 Karma

lukejadamec
Super Champion

Stupid question, but why is this information so hard to find from the CVE report or from Splunk?

jbsplunk
Splunk Employee
Splunk Employee

Universal Forwarder's don't use search, so this isn't relevant to those installations. For other forwarder installs, SPL-70250 is scheduled to be fixed for 4.3.8.

the_wolverine
Champion

Thanks and it would be nice if Splunk would publish this information with the vuln.

0 Karma

splunkIT
Splunk Employee
Splunk Employee

jbsplunk is a badass, and you rock!!

0 Karma

lukejadamec
Super Champion

Rock-on dude.

Chubbybunny
Splunk Employee
Splunk Employee

Thanks JB!!

0 Karma

the_wolverine
Champion

Just confirmed with Splunk that this vulnerability applies to all instances, including forwarders.

You will need to contact support for solutions.

lukejadamec
Super Champion

Bummer dude

Get Updates on the Splunk Community!

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

What's New in Splunk Observability Cloud and Splunk AppDynamics - May 2025

This month, we’re delivering several new innovations in Splunk Observability Cloud and Splunk AppDynamics ...