====================================================================

                              CERT-Renater

                  Note d'Information No. 2016/VULN394
_____________________________________________________________________

DATE                : 21/11/2016

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Splunk Enterprise versions 6,
                       5.0.x prior to 6.5.0, 6.4.4, 6.3.8, 6.2.12,
                       6.1.12, 6.0.13, 5.0.17
                      Splunk Light versions prior to 6.5.0.

=====================================================================
http://www.splunk.com/view/SP-CAAAPSR
____________________________________________________________________

Splunk Enterprise 6.5.0, 6.4.4, 6.3.8, 6.2.12, 6.1.12, 6.0.13, and
5.0.17 address multiple vulnerabilities


Table of Contents

• Description
• Affected Products and Components
• Mitigation and Upgrades
• Vulnerability Descriptions and Ratings
• Multiple Vulnerabilities in Python (CVE-2016-5636, CVE-2016-5699,
   CVE-2016-0772) (SPL-128812)
• HTTP Request Injection in Splunk Web (SPL-128840)


Description

     Multiple Vulnerabilities in Python (CVE-2016-5636, CVE-2016-5699,
      CVE-2016-0772) (SPL-128812)
     HTTP Request Injection in Splunk Web (SPL-128840)

At the time of this announcement, Splunk is not aware of any cases
where these vulnerabilities have been actively exploited. Previous
Product Security Announcements can be found on our Splunk Product
Security Portal. Use SPL numbers when referencing issues in
communication with Splunk. If there is no Common Vulnerabilities and
Exposures (CVE) identifier listed with a vulnerability, it will be
added once it is assigned by a CVE Numbering Authority. To standardize
the calculation of severity scores for each vulnerability, when
appropriate, Splunk uses Common Vulnerability Scoring System version 2
(CVSS v2).


Affected Products and Components

Multiple Vulnerabilities in Python (CVE-2016-5636, CVE-2016-5699,
CVE-2016-0772) (SPL-128812)

     Affected Product Versions: Splunk Enterprise versions 6.3.x before
6.3.8, 6.2.x before 6.2.12, 6.1.x before 6.1.12, 6.0.x before 6.0.13,
5.0.x before 5.0.17 and Splunk Light versions before 6.5.0

     Affected Components: All Splunk Enterprise components


HTTP Request Injection in Splunk Web (SPL-128840)

     Affected Product Versions: Splunk Enterprise versions 6.4.x before
6.4.4, 6.3.x before 6.3.8, 6.2.x before 6.2.12, 6.1.x before 6.1.12,
6.0.x before 6.0.13, 5.0.x before 5.0.17

     Affected Components: All Splunk Enterprise components running 
Splunk Web


Mitigation and Upgrades

To mitigate these issues, Splunk recommends upgrading to the latest
release and applying as many of the Hardening Standards from the
Securing Splunk documentation as are relevant to your environment.
Splunk Enterprise and Splunk Light releases are cumulative, meaning
that future releases will contain fixes to these vulnerabilities, new
features and other bug fixes.

     HTTP Request Injection in Splunk Web (SPL-128840): Blocking REST
API access (8089 by default) helps block successful exploitation of
this issue.

Vulnerability Descriptions and Ratings


Multiple Vulnerabilities in Python (CVE-2016-5636, CVE-2016-5699,
CVE-2016-0772) (SPL-128812)

Description: Splunk Enterprise versions 6.3.x before 6.3.8, 6.2.x
before 6.2.12, 6.1.x before 6.1.12, 6.0.x before 6.0.13, 5.0.x before
5.0.17 and Splunk Light versions before 6.5.0 are affected by multiple
vulnerabilities in Python (1, 2, 3). Python 2.7.12 security fixes were
backported.

Notes: These Python issues were not addressed in Splunk 6.4.4 and will
be addressed in a future maintenance release.

HTTP Request Injection in Splunk Web (SPL-128840)

Description: Splunk Enterprise versions 6.4.x before 6.4.4, 6.3.x
before 6.3.8, 6.2.x before 6.2.12, 6.1.x before 6.1.12, 6.0.x before
6.0.13, 5.0.x before 5.0.17 are affected by an HTTP request injection
vulnerability that permits leakage of authentication tokens. The
authorization tokens permit an attacker to use the Splunk REST API with
the same rights as the user.

Credits: Splunk would like to thank Francesco
Oddo/security-assessment.com for reporting this issue.

CVSS Severity (version 2.0):
CVSS Base Score	10.0
CVSS Impact Subscore	10.0
CVSS Exploitability Subscore	10.0
Overall CVSS Score	9.4

==========================================================
Serveur de référence du CERT-Renater
https://services.renater.fr/ssi/
==========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44           +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41           +
+ 75013 Paris           | email: cert@support.renater.fr +
==========================================================