- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

The following vuln, CVE-2013-6771, appears to only be fixed in 5.0.5 and newer:
http://www.splunk.com/view/SP-CAAAH76
Does this mean there will be no fix for 4.x forwarders and I will need to upgrade thousands of forwarders to version 5.0.5 at minimum?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Just confirmed with Splunk that this vulnerability applies to all instances, including forwarders.
You will need to contact support for solutions.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content


The vulnerability is a privilege escalation via a search mechanism. You can mitigate the problem by making it impossible for users to run searches on your forwarders, for example by not providing access to the management port, or by avoiding having accounts on those forwarders that anyone has the credentials for, or by not providing the search capability to any users who do exist on those systems, or a combination of any of the above.
Of of course as jbacking points out, by running UFs where executing search is not permitted at all.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content


As Our Wolverine intimates, there are tradeoffs between specificity and not. I tried to provide enough information to give mitigation information without giving steps to cause trouble. I'll relay this question along internally. It's possible I may be chided for saying more than is desirable. We'll see.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hence the stupid question preface, put a cork in it.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

@lukejadamec, posting specifics of such a vuln would potentially give free information away to someone with malicious intent.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Stupid question, but why is this information so hard to find from the CVE report or from Splunk?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Universal Forwarder's don't use search, so this isn't relevant to those installations. For other forwarder installs, SPL-70250 is scheduled to be fixed for 4.3.8.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Thanks and it would be nice if Splunk would publish this information with the vuln.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

jbsplunk is a badass, and you rock!!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Rock-on dude.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Thanks JB!!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Just confirmed with Splunk that this vulnerability applies to all instances, including forwarders.
You will need to contact support for solutions.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Bummer dude
