Splunk Critical Maintenance Release and Patch

Table of Contents

Description

Splunk has released critical maintenance releases and a patch to address several vulnerabilities in Splunk versions 4.0 through 4.1.1. At the time of this announcement, Splunk is not aware of any cases where any of these vulnerabilities have been exploited.

Due to the threat posed by a successful attack, Splunk strongly recommends that all instances of Splunk running the Splunk Web component be updated immediately to the newest maintenance release.

If you are unable to perform an immediate upgrade, Splunk strongly recommends that you immediately apply a critical patch to all affected versions of Splunk running Splunk Web to address the most serious vulnerability.

Splunk also recommends that you apply as many components of the Splunk Hardening Standards as possible to mitigate the risk and impact of exploitation.

Products and Components Affected

Security vulnerabilities addressed by this critical maintenance release and patch affect the following versions of Splunk running the Splunk Web component:

• Splunk 4.0 through 4.0.10
• Splunk 4.1 through 4.1.1

Security vulnerabilities addressed by this critical maintenance release and patch affect the Splunk Web component of the Splunk server software. Splunk Web refers to the web server used to deliver the Splunk user interface to the client browser. By default, Splunk light forwarders disable Splunk Web and are not affected.

Upgrades and Patches

Due to the threat posed by the possibility of a successful attack, Splunk strongly recommends that all instances of Splunk running the Splunk Web component be updated immediately to the newest maintenance release.

Splunk releases are cumulative, meaning that releases posted subsequent to those we are posting today will contain these fixes to these vulnerabilities as well as new features and fixes to other bugs and flaws.

If you are unable to perform an upgrade, Splunk strongly recommends that you apply a critical patch to all versions of Splunk running Splunk Web immediately. However, the patch supplied will only mitigate the most critical vulnerability issued in this announcement, Directory traversal in Splunk Web (SPL-31194).

Splunk recommends that customers only apply the patch as a last resort, in situations where they are unable to upgrade immediately.

Credit Statement

Splunk would like to extend a huge thank you to aaron@vtty.com for responsibly reporting each of the vulnerabilities fixed in the newest maintenance releases and patch. We have credited him below in each vulnerability description.

Vulnerability Descriptions and Ratings

The following are descriptions and ratings for vulnerabilities that are fixed in the newest maintenance releases. Descriptions and ratings for previous security fixes can be found in previous Product Security Announcements on our Product Security Portal.

SPL numbers are to be used in communication with Splunk to address specific vulnerabilities. If there is no CVE listed with the vulnerability, the CVE will be added as it is posted.

Directory traversal in Splunk Web (SPL-31194) (CVE-2010-2502)

Directory traversal with uploads in Splunk Web (SPL-31063) (CVE-2010-2502)

Reflective Cross-site Scripting and Directory Traversal with Redirects in Splunk Web (SPL-31067) (CVE-2010-2503)

Cross-site Scripting with Splunk Web (SPL-31084) (CVE-2010-2503)

Cross-site Scripting with User Input in Splunk Web (SPL-31085) (CVE-2010-2503)

HTTP Header Injection in Splunk Web (SPL-31066) (CVE-2010-2504)

Document History

• 2010-May-03: Rev 1. Initial Release