Vulnerability-Lookup

CERTA-2010-AVI-445

Vulnerability from certfr_avis - Published: 2010-09-20 - Updated: 2010-09-20

Deux vulnérabilités corrigées dans Splunk permettent à un attaquant d'élever ses provilèges et d'accéder frauduleusement à des informations confidentielles.

Description

Une erreur dans l'analyseur syntaxique de documents XML permet à un attaquant authentifié d'élever ses privilèges et d'accéder à des informations confidentielles.

La clé de session peut être obtenue par une personne malintentionnée en forçant un utilisateur à visiter une page malveillante spécialement construite. Cette clé peut alors être réutilisée pour obtenir les mêmes privilèges.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Splunk versions 4.0 à 4.1.4.

Impacted products

	Vendor	Product	Description

References

Title

Publication Time

Tags

Bulletin de sécurité Splunk SP-CAAAFQ6 du 09 septembre 2010

None

vendor-advisory

Show details on source website

JSON

To clipboard Create KEV Entry

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [],
  "affected_systems_content": "\u003cSPAN class=\"textit\"\u003eSplunk\u003c/SPAN\u003e  versions 4.0 \u00e0 4.1.4.",
  "content": "## Description\n\nUne erreur dans l\u0027analyseur syntaxique de documents XML permet \u00e0 un\nattaquant authentifi\u00e9 d\u0027\u00e9lever ses privil\u00e8ges et d\u0027acc\u00e9der \u00e0 des\ninformations confidentielles.\n\nLa cl\u00e9 de session peut \u00eatre obtenue par une personne malintentionn\u00e9e en\nfor\u00e7ant un utilisateur \u00e0 visiter une page malveillante sp\u00e9cialement\nconstruite. Cette cl\u00e9 peut alors \u00eatre r\u00e9utilis\u00e9e pour obtenir les m\u00eames\nprivil\u00e8ges.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2010-3322",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-3322"
    },
    {
      "name": "CVE-2010-3323",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-3323"
    }
  ],
  "initial_release_date": "2010-09-20T00:00:00",
  "last_revision_date": "2010-09-20T00:00:00",
  "links": [],
  "reference": "CERTA-2010-AVI-445",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2010-09-20T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "Deux vuln\u00e9rabilit\u00e9s corrig\u00e9es dans \u003cspan class=\"textit\"\u003eSplunk\u003c/span\u003e\npermettent \u00e0 un attaquant d\u0027\u00e9lever ses provil\u00e8ges et d\u0027acc\u00e9der\nfrauduleusement \u00e0 des informations confidentielles.\n",
  "title": "Vuln\u00e9rabilit\u00e9s dans Splunk 4.1.5",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Splunk SP-CAAAFQ6 du 09 septembre 2010",
      "url": "http://www.splunk.com/view/SP-CAAAFQ6"
    }
  ]
}

CVE-2010-3323 (GCVE-0-2010-3323)

Vulnerability from cvelistv5 – Published: 2010-09-14 16:39 – Updated: 2024-09-16 18:33

Summary

Splunk 4.0.0 through 4.1.4 allows remote attackers to conduct session hijacking attacks and obtain the splunkd session key via vectors related to the SPLUNKD_SESSION_KEY parameter.

Severity ?

No CVSS data available.

CWE

Assigner

mitre

References

URL

Tags

http://www.splunk.com/view/SP-CAAAFQ6

x_refsource_CONFIRM

Show details on NVD website

JSON

To clipboard Create KEV Entry

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T03:03:19.172Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.splunk.com/view/SP-CAAAFQ6"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Splunk 4.0.0 through 4.1.4 allows remote attackers to conduct session hijacking attacks and obtain the splunkd session key via vectors related to the SPLUNKD_SESSION_KEY parameter."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2010-09-14T16:39:00Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.splunk.com/view/SP-CAAAFQ6"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2010-3323",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Splunk 4.0.0 through 4.1.4 allows remote attackers to conduct session hijacking attacks and obtain the splunkd session key via vectors related to the SPLUNKD_SESSION_KEY parameter."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://www.splunk.com/view/SP-CAAAFQ6",
              "refsource": "CONFIRM",
              "url": "http://www.splunk.com/view/SP-CAAAFQ6"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2010-3323",
    "datePublished": "2010-09-14T16:39:00Z",
    "dateReserved": "2010-09-13T00:00:00Z",
    "dateUpdated": "2024-09-16T18:33:48.501Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2010-3322 (GCVE-0-2010-3322)

Vulnerability from cvelistv5 – Published: 2010-09-14 16:39 – Updated: 2024-09-16 16:44

Summary

The XML parser in Splunk 4.0.0 through 4.1.4 allows remote authenticated users to obtain sensitive information and gain privileges via an XML External Entity (XXE) attack to unknown vectors.

Severity ?

No CVSS data available.

CWE

Assigner

mitre

References

URL

Tags

http://www.splunk.com/view/SP-CAAAFQ6

x_refsource_CONFIRM

Show details on NVD website

JSON

To clipboard Create KEV Entry

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T03:03:18.992Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.splunk.com/view/SP-CAAAFQ6"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The XML parser in Splunk 4.0.0 through 4.1.4 allows remote authenticated users to obtain sensitive information and gain privileges via an XML External Entity (XXE) attack to unknown vectors."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2010-09-14T16:39:00Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.splunk.com/view/SP-CAAAFQ6"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2010-3322",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The XML parser in Splunk 4.0.0 through 4.1.4 allows remote authenticated users to obtain sensitive information and gain privileges via an XML External Entity (XXE) attack to unknown vectors."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://www.splunk.com/view/SP-CAAAFQ6",
              "refsource": "CONFIRM",
              "url": "http://www.splunk.com/view/SP-CAAAFQ6"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2010-3322",
    "datePublished": "2010-09-14T16:39:00Z",
    "dateReserved": "2010-09-13T00:00:00Z",
    "dateUpdated": "2024-09-16T16:44:07.698Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CERTA-2010-AVI-445

Description

Solution

CVE-2010-3323 (GCVE-0-2010-3323)

CVE-2010-3322 (GCVE-0-2010-3322)

Tags

Sightings

Nomenclature