SNS Vulnerability

AlienVault Unified Security Management Multiple Vulnerabilities Fixed by 5.3.2

Description

(#Several vulnerabilities were reported in AlienVault Unified Security Management:#- ENG-103100: predictable temporary files filenames and improper set of Content-Type header. A remote attacker could exploit it by enticing their victim into uploading a specially crafted NBE file in order to execute arbitrary JavaScript code##- ENG-103442: improper handling of specific requests to make the application unavailable##- ENG-103880: an attacker could modify requests to forge permissions and then delete alarms##- CVE-2016-8583: cross-site scripting in several parameters (including jobname, timeout, sched_id and targets) of an URL in vulnerability scan scheduler##- ENG-103929: cross-site scripting in the "User-Agent" header of the login process (CVE-2016-8581)##- ENG-103930: injection SQL in the "value" parameter of the "/ossim/dashboard/sections/widgets/data/gauge.php" page and triggerable via the "type" parameter (CVE-2016-8582)##- ENG-103931: arbitrary PHP object injection in several widget files (CVE-2016-8580)##- ENG-104047: command injection in backup password.#Updated 02/11/2016:#Proofs of concept are available (CVE-2016-8580, CVE-2016-8581, CVE-2016-8582, CVE-2016-8583).)

Vulnerable Products

Vulnerable Software:
Unified Security Management (AlienVault) - 1.0, 2.0, 3.0, 4.0, 4.1, ..., 5.2.3, 5.2.4, 5.2.5, 5.3, 5.3.1

Solution

AlienVault has released version 5.3.2 of Unified Security Management which fixes these vulnerabilities.

CVE

CVE-2016-8583
CVE-2016-8582
CVE-2016-8581
CVE-2016-8580

References

- AlienVault : 5.3.2 address 70 vulnerabilities
https://www.alienvault.com/forums/discussion/7766/security-advisory-alienvault-5-3-2-address-70-vulnerabilities

Vulnerability Manager Detection

IPS Protection

ASQ Engine alarm	Available Since
XSS - Prevention - GET : suspicious 'iframe' tag found in URL	3.2.0
XSS - Prevention - GET : suspicious 'meta' tag found in URL	3.2.0
SQL injection Prevention - GET : suspicious OR statement in URL	3.2.0
XSS - Prevention - GET : suspicious tag with event found in URL	3.2.0
XSS - Prevention - GET : suspicious 'applet' tag found in URL	3.2.0
SQL injection Prevention - GET : suspicious combination of 'OR' or 'AND' statements in URL	3.2.0
SQL injection Prevention - GET : suspicious CREATE statement in URL	3.2.0
SQL injection Prevention - GET : suspicious CAST statement in URL	3.2.0
SQL injection Prevention - GET : suspicious OPENROWSET statement in URL	3.2.0
SQL injection Prevention - GET : suspicious DECLARE statement in URL	3.2.0
XSS - Phishing : suspicious 'div' tag found in URL	3.2.0
XSS - Prevention - GET : suspicious 'style' attribute found in URL	3.2.0
XSS - Prevention - GET : suspicious 'img' tag found in URL	3.2.0
SQL injection Prevention - GET : suspicious OPENQUERY statement in URL	3.2.0
SQL injection Prevention - GET : suspicious shutdown statement in URL	3.2.0
SQL injection Prevention - GET : suspicious UNION SELECT statement in URL	3.2.0
SQL injection Prevention - GET : possible database version probing	3.2.0
XSS - Phishing : suspicious 'a' tag found in URL	3.2.0
XSS - Prevention - GET : cookie access attempt using script language found in URL	3.2.0
SQL injection Prevention - GET : suspicious UPDATE SET statement in URL	3.2.0
XSS - Prevention - GET : suspicious 'embed' tag found in URL	3.2.0
XSS - Prevention - GET : suspicious 'object' tag found in URL	3.2.0
SQL injection Prevention - GET : suspicious SELECT statement in URL	3.2.0
XSS - Phishing : suspicious 'form' tag found in URL	3.2.0
SQL injection Prevention - GET : suspicious INSERT statement in URL	3.2.0
XSS - Prevention - GET : javascript code found in URL	3.2.0
SQL injection Prevention - GET : suspicious DROP statement in URL	3.2.0
SQL injection Prevention - GET : suspicious EXEC statement in URL	3.2.0
XSS - Prevention - GET : evasion attempt using tag characters encoding in URL	3.2.0
SQL injection Prevention - GET : block comment delimiters in URL	3.2.0
XSS - Prevention - GET : suspicious 'style' tag found in URL	3.2.0
XSS - Phishing : suspicious 'link' tag found in URL	3.2.0
XSS - Prevention - GET : 'script' tag found in URL	3.2.0
XSS - Prevention - GET : 'location' javascript object found in URL	3.2.0
XSS - Prevention - GET : suspicious 'div' tag found in URL	3.2.0
Code injection in HTTP User-Agent detected	4.1.2
XSS - Prevention : suspicious tag or javascript found in header	5.0.0
XSS - Prevention : suspicious 'document.cookie' found in header	5.0.0
SQL injection Prevention - GET : suspicious combination of 'select' and 'sleep' statements in URL	5.0.0
SQL injection Prevention - GET : Evasion attempt with CAST and EXEC statements	5.0.0
SQL injection Prevention - GET : Authentication bypass attempt with OR statement	5.0.0
XSS - Prevention : suspicious 'script' tag found in header	5.0.0
SQL injection Prevention - GET : suspicious SQL keywords in URL	5.0.0

Risk level

Moderate

Vulnerability First Public Report Date

2016-10-03

Target Type

Server

Possible exploit

Local & Remote