CVE-2014-3804

EPSS 72.4%

Vexday Risk Score

60Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

Exploit maturity

Functional exploit

Automatable exploit available (Nuclei/Metasploit).

CVSS —EPSS 72.4%KEV nãoPoC públicaNuclei —Metasploit simPatch —

Lifecycle

05 May 2014Metasploit module available

13 Jun 2014Published on NVD

24 Jun 2014Public PoC

Weaponization speed

10 daysto first PoC

Recommendation: Plan a near-term fix — a public PoC already exists.

The av-centerd SOAP service in AlienVault OSSIM before 4.7.0 allows remote attackers to execute arbitrary commands via a crafted (1) update_system_info_debian_package, (2) ossec_task, (3) set_ossim_setup admin_ip, (4) sync_rserver, or (5) set_ossim_setup framework_ip request, a different vulnerability than CVE-2014-3805.

Affected products

n/a · n/a

public PoCs found — 3

cve_referencewww.exploit-db.com/exploits/42708/unverified exploitdbwww.exploit-db.com/exploits/33865unverified exploitdbwww.exploit-db.com/exploits/42708unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://forums.alienvault.com/discussion/2690 https://www.exploit-db.com/exploits/42708/http://zerodayinitiative.com/advisories/ZDI-14-196/http://zerodayinitiative.com/advisories/ZDI-14-197/http://zerodayinitiative.com/advisories/ZDI-14-200/http://zerodayinitiative.com/advisories/ZDI-14-201/http://zerodayinitiative.com/advisories/ZDI-14-202/