Detections
Analytics
Snare Agent for Linux < 1.7.0 / 2.0.0 Multiple Vulnerabilities
medium Nessus Plugin ID 63334
Language:
Synopsis
The remote web server hosts an auditing application that is affected by multiple vulnerabilities.Description
According to its self-reported version number, the installation of Snare Agent for Linux hosted on the remote web server is affected by multiple vulnerabilities in the optionally configured web interface:- The web interface discloses a hashed password for remote logins. An attacker can view the page source at /remote and see the hashed password in the 'RemotePassword' field. (CVE-2011-5247)
- The web interface suffers from a cross-site scripting vulnerability because the application fails to sanitize input passed via logged events. An attacker could create a specially crafted request that would execute arbitrary script code in a user's browser.
(CVE-2011-5249)
- The web interface suffers from a cross-site request forgery (CSRF) vulnerability because it fails to properly implement the 'ChToken' parameter used to prevent CSRF attacks. (CVE-2011-5250)
Solution
Upgrade to version 1.7.0 / 2.0.0 or later.See Also
https://seclists.org/bugtraq/2012/Dec/76
https://seclists.org/bugtraq/2012/Dec/77
Plugin Details
Severity: Medium
ID: 63334
File Name: snare_linux_1_7_0.nasl
Version: 1.8
Type: remote
Family: CGI abuses
Published: 12/24/2012
Updated: 1/19/2021
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Low
Score: 3.8
CVSS v2
Risk Factor: Medium
Base Score: 4.3
Temporal Score: 3.4
Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N
CVSS Score Source: CVE-2011-5249
Vulnerability Information
CPE: cpe:/a:intersect_alliance:snare_agent
Required KB Items: www/snare_linux
Excluded KB Items: Settings/disable_cgi_scanning
Exploit Available: true
Exploit Ease: No exploit is required
Patch Publication Date: 8/9/2011
Vulnerability Publication Date: 8/9/2011
Reference Information
CVE: CVE-2011-5247, CVE-2011-5249, CVE-2011-5250
BID: 56883