Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT Security Bulletin
ASB-2016.0036
Multiple vulnerabilities have been identified in Splunk
Enterprise and Splunk Light
8 April 2016
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Splunk Enterprise
Splunk Light
Operating System: Windows
UNIX variants (UNIX, Linux, OSX)
Impact/Access: Access Privileged Data -- Remote/Unauthenticated
Execute Arbitrary Code/Commands -- Existing Account
Denial of Service -- Remote/Unauthenticated
Access Confidential Data -- Existing Account
Reduced Security -- Existing Account
Resolution: Patch/Upgrade
CVE Names: CVE-2016-0800 CVE-2015-7995
Member content until: Sunday, May 8 2016
Reference: ESB-2016.0140
ESB-2016.0543.2
OVERVIEW
Multiple vulnerabilities have been identified in Splunk Enterprise
prior to versions 6.3.3.4, 6.2.9. 6.1.10, 6.0.11, and 5.0.15 and
Splunk Light prior to versions 6.3.3.4 and 6.2.9. [1]
IMPACT
The vendor has provided the following information:
"Multiple vulnerabilities in OpenSSL including DROWN (CVE-2016-0800)
(SPL-110363, SPL-115028, SPL-115027, SPL-115026, SPL-115025)
Splunk Web Denial of Service via HTTP Header (SPL-102960,
SPL-102961, SPL-102241, SPL-103926)
Splunk Web Denial of Service via Malformed HTTP Requests
(SPL-106804, SPL-106800, SPL-103822, SPL-106803, SPL-106805)
Direct Object Access Vulnerability in Splunk Search (SPL-107199,
SPL-107197, SPL-107196, SPL-107123, SPL-116567)
User TLS protocol selection not honored (SPL-108213, SPL-115292)
Path traversal vulnerability in collect command (SPL-112516,
SPL-112517, SPL-112518, SPL-112519, SPL-114842)
Path traversal vulnerability in inputcsv and outputcsv commands
(SPL-115074, SPL-115075, SPL-115076, SPL-115077, SPL-115217)
Type confusion vulnerability in libxslt (CVE-2015-7995) (SPL-113082,
SPL-113083, SPL-113084, SPL-113085, SPL-116566)
At the time of this announcement, Splunk is not aware of any cases
where these vulnerabilities have been actively exploited." [1]
MITIGATION
Users should upgrade to the latest versions to address these issues.
[1]
REFERENCES
[1] Splunk Enterprise 6.3.3.4, 6.2.9. 6.1.10, 6.0.11, and 5.0.15 and
Splunk Light 6.3.3.4 and 6.2.9 address multiple vulnerabilities
http://www.splunk.com/view/SP-CAAAPKV
AusCERT has made every effort to ensure that the information contained
in this document is accurate. However, the decision to use the information
described is the responsibility of each user or organisation. The decision to
follow or act on information or advice contained in this security bulletin is
the responsibility of each user or organisation, and should be considered in
accordance with your organisation's site policies and procedures. AusCERT
takes no responsibility for consequences which may arise from following or
acting on information or advice contained in this security bulletin.
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBVwcnB36ZAP0PgtI9AQJ2gw/+Pd1418VkjsbiVT8VxABgTjhaHZGbiPhh
CLPQb+5E4/jCbDohLf9HDwQDxeBMaNJsvObK07oQldfJlxwyljG7mbwWBhLaR9lz
m+clnEsQVCvlPBPGNZvrTzcogB/fgm6l6pF2kobRKILPdkqjnGj6+7Wtil5PepaS
iHq+9eI5yS732CxcuvYDTksqNRDsI/4vI7uVCKDvz8dfbk4I/ca8su3QRraHVizW
5CJOXcgRmXCmPuLpKThTzZFSOil3CobkNwSiWj5PpX7VtFXz0FxwXJAtamajNr9P
MbEdZgXCxoFKnK/9gszufmhSI1eE0kjhhE9+3ks64BUVGembEondCQkR9tHgftpj
SQUfE4QtGFb7KhC7cQu8aia9VFuRIGDJ+8ljIugW3qzqvdDosrQ9ZT2NAU5MG4v8
NEB6KOW5rzVtIVwPIZdhy68OUvkj0SZl1m1NOqhx/mtmI3AEjqIVDPt36tfSez7d
mD+k67WsYUNEiphSkOZHH9IHX9yXiWkNj/pR4yumfRCriZEndfxdmhEhaQ+rhDoh
S9mlizr4F8gjNa1A7h00WPDyMTxefU2prJK8RLuv2WhBbNi7/+voroMOLtgiPYTo
UI2pj3Mh+0qjT0ty5GWcxtDXldUhpfd9mCz36g94fSqO1lyJpD5XoY0AF+gaNYku
YGh9vSV5lZ4=
=1UFI
-----END PGP SIGNATURE-----