Getting Data In

Does CVE-2013-6771 require upgrading to minimum 5.0.5?

the_wolverine
Champion

The following vuln, CVE-2013-6771, appears to only be fixed in 5.0.5 and newer:

http://www.splunk.com/view/SP-CAAAH76

Does this mean there will be no fix for 4.x forwarders and I will need to upgrade thousands of forwarders to version 5.0.5 at minimum?

1 Solution

the_wolverine
Champion

Just confirmed with Splunk that this vulnerability applies to all instances, including forwarders.

You will need to contact support for solutions.

View solution in original post

jrodman
Splunk Employee
Splunk Employee

The vulnerability is a privilege escalation via a search mechanism. You can mitigate the problem by making it impossible for users to run searches on your forwarders, for example by not providing access to the management port, or by avoiding having accounts on those forwarders that anyone has the credentials for, or by not providing the search capability to any users who do exist on those systems, or a combination of any of the above.

Of of course as jbacking points out, by running UFs where executing search is not permitted at all.

jrodman
Splunk Employee
Splunk Employee

As Our Wolverine intimates, there are tradeoffs between specificity and not. I tried to provide enough information to give mitigation information without giving steps to cause trouble. I'll relay this question along internally. It's possible I may be chided for saying more than is desirable. We'll see.

0 Karma

lukejadamec
Super Champion

Hence the stupid question preface, put a cork in it.

0 Karma

the_wolverine
Champion

@lukejadamec, posting specifics of such a vuln would potentially give free information away to someone with malicious intent.

0 Karma

lukejadamec
Super Champion

Stupid question, but why is this information so hard to find from the CVE report or from Splunk?

jbsplunk
Splunk Employee
Splunk Employee

Universal Forwarder's don't use search, so this isn't relevant to those installations. For other forwarder installs, SPL-70250 is scheduled to be fixed for 4.3.8.

the_wolverine
Champion

Thanks and it would be nice if Splunk would publish this information with the vuln.

0 Karma

splunkIT
Splunk Employee
Splunk Employee

jbsplunk is a badass, and you rock!!

0 Karma

lukejadamec
Super Champion

Rock-on dude.

Chubbybunny
Splunk Employee
Splunk Employee

Thanks JB!!

0 Karma

the_wolverine
Champion

Just confirmed with Splunk that this vulnerability applies to all instances, including forwarders.

You will need to contact support for solutions.

lukejadamec
Super Champion

Bummer dude

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...