CVE-2014-3804

Name of the Vulnerable Software and Affected Versions AlienVault OSSIM versions prior to 4.7.0

Description The issue allows remote attackers to execute arbitrary commands via crafted requests to specific API endpoints, including update system info debian package, ossec task, set ossim setup admin ip, sync rserver, and set ossim setup framework ip. This is a remote code execution issue.

Recommendations For versions prior to 4.7.0, update to version 4.7.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable API endpoints until a patch is available. Avoid using the vulnerable functions update system info debian package, ossec task, set ossim setup admin ip, sync rserver, and set ossim setup framework ip in the affected AlienVault OSSIM versions until the issue is resolved.