Design/Logic Flaw

In OSSEC-HIDS 2.7 through 3.5.0, the OSCleanMSG function in ossec-analysisd doesn't remove or encode terminal control characters or newlines from processed log messages. In many cases, those characters are later logged. Because newlines \n are permitted in messages processed by ossec-analysisd, i...

Null pointer dereference

In OSSEC-HIDS 2.7 through 3.5.0, the server component responsible for log analysis ossec-analysisd is vulnerable to a denial of service NULL pointer dereference via crafted messages written directly to the analysisd UNIX domain socket by a local user...

Heap overflow

In OSSEC-HIDS 2.7 through 3.5.0, the server component responsible for log analysis ossec-analysisd is vulnerable to an off-by-one heap-based buffer overflow during the cleaning of crafted syslog msgs received from authenticated remote agents and delivered to the analysisd processing queue by...

CVE-2020-8442

In OSSEC-HIDS 2.7 through 3.5.0, the server component responsible for log analysis ossec-analysisd is vulnerable to a heap-based buffer overflow in the rootcheck decoder component via an authenticated client...

CVE-2020-8442

CVE-2020-8442 affects OSSEC-HIDS up to version 3.5.0. The vulnerability is a heap-based buffer overflow in the rootcheck decoder inside the server component responsible for log analysis (ossec-analysisd) when accessed by an authenticated client. Affected range: OSSEC-HIDS 2.7–3.5.0. Exploitation ...

CVE-2020-8443

In OSSEC-HIDS 2.7 through 3.5.0, the server component responsible for log analysis ossec-analysisd is vulnerable to an off-by-one heap-based buffer overflow during the cleaning of crafted syslog msgs received from authenticated remote agents and delivered to the analysisd processing queue by...

CVE-2020-8443

CVE-2020-8443 affects OSSEC-HIDS 2.7–3.5.0: the server component ossec-analysisd is vulnerable to an off-by-one heap-based buffer overflow when cleaning crafted syslog messages passed from authenticated remote agents via ossec-remoted into the analysis queue. Public disclosures across multiple fe...

CVE-2020-8444

In OSSEC-HIDS 2.7 through 3.5.0, the server component responsible for log analysis ossec-analysisd is vulnerable to a use-after-free during processing of ossec-alert formatted msgs received from authenticated remote agents and delivered to the analysisd processing queue by ossec-remoted...

CVE-2020-8444

CVE-2020-8444 affects OSSEC-HIDS server component ossec-analysisd (versions 2.7–3.5.0) and is due to a use-after-free while processing ossec-alert messages from authenticated remote agents via ossec-remoted. Public data assigns a CVSS v3.1 base score of 9.8 (CRITICAL; NETWORK attack, no privilege...

CVE-2020-8445

In OSSEC-HIDS 2.7 through 3.5.0, the OSCleanMSG function in ossec-analysisd doesn't remove or encode terminal control characters or newlines from processed log messages. In many cases, those characters are later logged. Because newlines \n are permitted in messages processed by ossec-analysisd, i...

CVE-2020-8445

CVE-2020-8445 affects OSSEC-HIDS 2.7–3.5.0. The OS_CleanMSG function in ossec-analysisd fails to strip/encode terminal control characters and newlines, allowing injected nested events or obfuscated log content. This may enable an unauthenticated remote attack for certain logged data types/origins...

CVE-2020-8446

CVE-2020-8446 affects OSSEC-HIDS 2.7–3.5.0. The server component ossec-analysisd is vulnerable to a path traversal with write access, exploitable by a local user through crafted syscheck messages sent to the analysisd UNIX domain socket. Impact: integrity is HIGH, confidentiality and availability...

CVE-2020-8446

In OSSEC-HIDS 2.7 through 3.5.0, the server component responsible for log analysis ossec-analysisd is vulnerable to path traversal with write access via crafted syscheck messages written directly to the analysisd UNIX domain socket by a local user...

CVE-2020-8447

In OSSEC-HIDS 2.7 through 3.5.0, the server component responsible for log analysis ossec-analysisd is vulnerable to a use-after-free during processing of syscheck formatted msgs received from authenticated remote agents and delivered to the analysisd processing queue by ossec-remoted...

CVE-2020-8447

OSSEC-HIDS CVE-2020-8447 affects ossec-analysisd (server component) in versions 2.7 through 3.5.0, with a use-after-free vulnerability when processing syscheck-formatted messages delivered to the analysis queue by ossec-remoted. Impact is high (CVE details indicate partial confidentiality/integri...

CVE-2020-8448

In OSSEC-HIDS 2.7 through 3.5.0, the server component responsible for log analysis ossec-analysisd is vulnerable to a denial of service NULL pointer dereference via crafted messages written directly to the analysisd UNIX domain socket by a local user...

CVE-2020-8448

OSSEC-HIDS CVE-2020-8448 affects 2.7–3.5.0; the server component ossec-analysisd is vulnerable to a denial of service via a NULL pointer dereference when local users craft messages sent to the analysisd UNIX domain socket. Impact is a local DoS with partial availability impact per CVSS. Mitigatio...

PT-2020-20146 · Trend Micro · Ossec-Hids

Name of the Vulnerable Software and Affected Versions: OSSEC-HIDS versions 2.7 through 3.5.0 Description: The server component responsible for log analysis, ossec-analysisd, is vulnerable to path traversal with write access via crafted syscheck messages written directly to the analysisd UNIX doma...

PT-2020-20142 · Trend Micro · Ossec-Hids

Name of the Vulnerable Software and Affected Versions: OSSEC-HIDS versions 2.7 through 3.5.0 Description: The server component responsible for log analysis, ossec-analysisd, is vulnerable to a heap-based buffer overflow in the rootcheck decoder component via an authenticated client...

PT-2020-20145 · Trend Micro · Ossec-Hids

Name of the Vulnerable Software and Affected Versions: OSSEC-HIDS versions 2.7 through 3.5.0 Description: The issue arises from the OS CleanMSG function in ossec-analysisd, which fails to remove or encode terminal control characters or newlines from processed log messages. This can lead to the...