Splunk Multiple Cross-Site Scripting and Denial of Service Vulnerabilities

Bugtraq ID:	56581
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Nov 19 2012 12:00AM
Updated:	Nov 19 2012 12:00AM
Credit:	Reported by the vendor, Commonwealth Bank of Australia's CBAcert team and Alexander Klink of n.runs AG
Vulnerable:	Splunk Splunk 4.3.1 Splunk Splunk 4.2.5 Splunk Splunk 4.1.6 Splunk Splunk 4.1.3 Splunk Splunk 4.1.2 Splunk Splunk 4.1.1 Splunk Splunk 4.0.11 Splunk Splunk 4.0.10 Splunk Splunk 4.0.9 Splunk Splunk 4.0.8 Splunk Splunk 4.0.7 Splunk Splunk 4.0.6 Splunk Splunk 4.0.5 Splunk Splunk 4.0.4 Splunk Splunk 4.0.3 Splunk Splunk 4.0.2 Splunk Splunk 4.0.1 Splunk Splunk 4.0 Splunk Splunk 4.3 Splunk Splunk 4.2.4 Splunk Splunk 4.2.3 Splunk Splunk 4.2.2 Splunk Splunk 4.2 Splunk Splunk 4.1.5 Splunk Splunk 4.1.4 Splunk Splunk 4.1
Not Vulnerable:

Splunk Multiple Cross-Site Scripting and Denial of Service Vulnerabilities

Splunk is prone to multiple cross-site scripting vulnerabilities and a denial-of-service vulnerability because it fails to properly handle user-supplied input.

An attacker may leverage these issues to cause denial-of-service conditions or to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Splunk Multiple Cross-Site Scripting and Denial of Service Vulnerabilities

To exploit the cross-site scripting issues, an attacker must entice an unsuspecting user to follow a malicious URI. To exploit the denial-of-service issue, attackers can use readily available tools.

The following example packet is available:

• /data/vulnerabilities/exploits/56581.txt

Splunk Multiple Cross-Site Scripting and Denial of Service Vulnerabilities

Solution:
Updates are available. Please see the reference for more details.

Splunk Multiple Cross-Site Scripting and Denial of Service Vulnerabilities

References:

• Splunk Homepage (Splunk)