Splunk version 4.1.5 contains fixes for two security vulnerabilities:
At the time of this announcement, Splunk is not aware of any cases where these vulnerabilities have been exploited. Splunk recommends that customers upgrade any instances of Splunk running Splunk Web, such as index and search servers, to the latest maintenance release as soon as possible.
Splunk also recommends that you apply as many components of the Splunk Hardening Standards as possible to mitigate the risk and impact of exploitation.
Security vulnerabilities addressed by this maintenance release affect the following versions of Splunk running the Splunk Web component:
Security vulnerabilities addressed by this maintenance release affect the Splunk Web component of the Splunk server software. Splunk Web refers to the web server used to deliver the Splunk user interface to the client browser. By default, Splunk light forwarders disable Splunk Web and are not affected.
Splunk recommends that all vulnerable instances of Splunk running the Splunk Web component be updated to the latest maintenance release.
Splunk Version Recommendation
4.0 to 4.1.4 Upgrade to the latest maintenance release
Splunk releases are cumulative, meaning that releases posted subsequent to those we are posting today will contain these fixes to these vulnerabilities as well as new features and fixes to other bugs and flaws.
Splunk would like to credit aaron@vtty.com for responsibly reporting these vulnerabilities. Thanks again, Aaron!
The following are descriptions and ratings for vulnerabilities that are fixed in the newest maintenance releases. Descriptions and ratings for previous security fixes can be found in previous Product Security Announcements on our Product Security Portal.
SPL numbers are to be used in communication with Splunk to address specific vulnerabilities. If there is no CVE listed with the vulnerability, the CVE will be added as it is posted.
Description: Splunk’s XML parser is vulnerably to XXE (XML eXternal Entity) attacks. An authenticated user could exploit this vulnerability, causing information disclosure and privilege escalation.
Versions Affected: Splunk 4.0.0 - 4.1.4
Credit: Thanks to aaron@vtty.com for responsibly disclosing this issue.
CVSS Severity (version 2.0):
CVSS Base Score | 6 |
CVSS Impact Subscore | 6.4 |
CVSS Exploitability Subscore | 6.8 |
CVSS Version 2 Metrics
Mitigation and Remediation:
Description: The parameter SPLUNKD_SESSION_KEY is vulnerable to session hijacking. An authenticated user could be tricked into visiting a specially crafted web page that could disclose a valid splunkd session key to an attacker.
Versions Affected: Splunk 4.0.0 - 4.1.4
Credit: Thanks to aaron@vtty.com for responsibly disclosing this issue.
CVSS Severity (version 2.0):
CVSS Base Score | 4.6 |
CVSS Impact Subscore | 6.4 |
CVSS Exploitability Subscore | 3.9 |
CVSS Version 2 Metrics
Mitigation and Remediation: