Does CVE-2013-6771 require upgrading to minimum 5.0.5?

[the_wolverine]

The following vuln, CVE-2013-6771, appears to only be fixed in 5.0.5 and newer:

http://www.splunk.com/view/SP-CAAAH76

Does this mean there will be no fix for 4.x forwarders and I will need to upgrade thousands of forwarders to version 5.0.5 at minimum?

[jrodman]

The vulnerability is a privilege escalation via a search mechanism. You can mitigate the problem by making it impossible for users to run searches on your forwarders, for example by not providing access to the management port, or by avoiding having accounts on those forwarders that anyone has the credentials for, or by not providing the search capability to any users who do exist on those systems, or a combination of any of the above.

Of of course as jbacking points out, by running UFs where executing search is not permitted at all.

[jrodman]

As Our Wolverine intimates, there are tradeoffs between specificity and not. I tried to provide enough information to give mitigation information without giving steps to cause trouble. I'll relay this question along internally. It's possible I may be chided for saying more than is desirable. We'll see.

[lukejadamec]

Hence the stupid question preface, put a cork in it.

[the_wolverine]

@lukejadamec, posting specifics of such a vuln would potentially give free information away to someone with malicious intent.

[lukejadamec]

Stupid question, but why is this information so hard to find from the CVE report or from Splunk?

[jbsplunk]

Universal Forwarder's don't use search, so this isn't relevant to those installations. For other forwarder installs, SPL-70250 is scheduled to be fixed for 4.3.8.

[the_wolverine]

Thanks and it would be nice if Splunk would publish this information with the vuln.

[splunkIT]

jbsplunk is a badass, and you rock!!

[lukejadamec]

Rock-on dude.

[Chubbybunny]

Thanks JB!!

[the_wolverine · Accepted solution]

Just confirmed with Splunk that this vulnerability applies to all instances, including forwarders.

You will need to contact support for solutions.

[lukejadamec]

Bummer dude