Getting Data In

Does CVE-2013-6771 require upgrading to minimum 5.0.5?

Champion

The following vuln, CVE-2013-6771, appears to only be fixed in 5.0.5 and newer:

http://www.splunk.com/view/SP-CAAAH76

Does this mean there will be no fix for 4.x forwarders and I will need to upgrade thousands of forwarders to version 5.0.5 at minimum?

1 Solution

Champion

Just confirmed with Splunk that this vulnerability applies to all instances, including forwarders.

You will need to contact support for solutions.

View solution in original post

Splunk Employee
Splunk Employee

The vulnerability is a privilege escalation via a search mechanism. You can mitigate the problem by making it impossible for users to run searches on your forwarders, for example by not providing access to the management port, or by avoiding having accounts on those forwarders that anyone has the credentials for, or by not providing the search capability to any users who do exist on those systems, or a combination of any of the above.

Of of course as jbacking points out, by running UFs where executing search is not permitted at all.

Splunk Employee
Splunk Employee

As Our Wolverine intimates, there are tradeoffs between specificity and not. I tried to provide enough information to give mitigation information without giving steps to cause trouble. I'll relay this question along internally. It's possible I may be chided for saying more than is desirable. We'll see.

0 Karma

Super Champion

Hence the stupid question preface, put a cork in it.

0 Karma

Champion

@lukejadamec, posting specifics of such a vuln would potentially give free information away to someone with malicious intent.

0 Karma

Super Champion

Stupid question, but why is this information so hard to find from the CVE report or from Splunk?

Splunk Employee
Splunk Employee

Universal Forwarder's don't use search, so this isn't relevant to those installations. For other forwarder installs, SPL-70250 is scheduled to be fixed for 4.3.8.

Champion

Thanks and it would be nice if Splunk would publish this information with the vuln.

0 Karma

Splunk Employee
Splunk Employee

jbsplunk is a badass, and you rock!!

0 Karma

Super Champion

Rock-on dude.

Splunk Employee
Splunk Employee

Thanks JB!!

0 Karma

Champion

Just confirmed with Splunk that this vulnerability applies to all instances, including forwarders.

You will need to contact support for solutions.

View solution in original post

Super Champion

Bummer dude