Splunk Enterprise 7.0.0.1/7.0.1, 6.6.3.2/6.6.4, 6.5.6, 6.4.9 and 6.3.12 address multiple SAML vulnerabilities

Description

Splunk Enterprise 7.0.0.1/7.0.1, 6.6.3.2/6.6.4, 6.5.6, 6.4.9 and 6.3.12 address multiple SAML vulnerabilities.

• Multiple SAML implementation vulnerabilities in Splunk Enterprise (CVE-2017-17067)

Please note, as of 2017-Nov-14, all affected Splunk Cloud customers have been updated.

At the time of this announcement, Splunk is not aware of any cases where these vulnerabilities have been actively exploited. Previous Product Security Announcements can be found on our Splunk Product Security Portal. Use SPL numbers when referencing issues in communication with Splunk. If there is no Common Vulnerabilities and Exposures (CVE) identifier listed with a vulnerability, it will be added once it is assigned by a CVE Numbering Authority. To standardize the calculation of severity scores for each vulnerability, when appropriate, Splunk uses Common Vulnerability Scoring System version 2 (CVSS v2).

Affected Products and Components

• Affected Product Versions: Splunk Enterprise versions 7.0.x before 7.0.0.1/7.0.1, 6.6.x before 6.6.3.2/6.6.4, 6.5.x before 6.5.6, 6.4.x before 6.4.9, 6.3.x before 6.3.12. All Splunk cloud instances using SAML have been updated to 6.6.3.2.
• Affected Components: All Splunk Enterprise components running Splunk Web with SAML authentication enabled.
• Unaffected Components: Universal Forwarders and Splunk Enterprise instances where Splunk Web is disabled or not using SAML authentication.

Mitigation and Upgrades

1. Check if you are running one of the following Splunk Enterprise versions

- 7.0.x before 7.0.0.1/7.0.1

- 6.6.x before 6.6.3.2/6.6.4

- 6.5.x before 6.5.6

- 6.4.x before 6.4.9

- 6.3.x before 6.3.12

$SPLUNK_HOME/bin/splunk version

2. Check if you have SAML login enabled.

Linux:

$SPLUNK_HOME/bin/splunk btool authentication list | grep authType

Windows:

$SPLUNK_HOME\bin\splunk btool authentication list | find "authType"

If 'authType' contains the word 'SAML', then this indicates a vulnerable configuration of Splunk and should be patched immediately.

For more information, see the SAML Troubleshooting documentation.

To mitigate this issue, Splunk recommends upgrading to one of the latest releases and applying as many of the Hardening Standards from the Securing Splunk documentation as are relevant to your environment. Splunk Enterprise releases are cumulative, meaning that future releases will contain fixes to these vulnerabilities, new features and other bug fixes.

Vulnerability Descriptions and Ratings

Multiple SAML implementation vulnerabilities in Splunk Enterprise (CVE-2017-17067)