According to its self-reported version number, the version of Splunk Enterprise hosted on the remote web server is 5.0.x prior to 5.0.17, 6.0.x prior to 6.0.13, 6.1.x prior to 6.1.12, 6.2.x prior to 6.2.12, 6.3.x prior to 6.3.8, or 6.4.x prior to 6.4.4; or else it is Splunk Light prior to 6.5.0. It is, therefore, affected by multiple vulnerabilities :

  - A heap buffer overflow condition exists in Python,     specifically in the get_data() function within file     Modules/zipimport.c, due to improper validation of     user-supplied input. An unauthenticated, remote attacker     can exploit this, via negative data size values, to     cause a denial of service condition or the possible     execution of arbitrary code. (CVE-2016-5636)

  - A CRLF injection vulnerability exists in Python,     specifically in the HTTPConnection.putheader() function     within file Modules/zipimport.c. An unauthenticated,     remote attacker can exploit this to inject arbitrary     HTTP headers via CRLF sequences in a URL, allowing     cross-site scripting (XSS) and other attacks.
    (CVE-2016-5699)

  - A flaw exists in Python within the smtplib library due     to a failure to properly raise exceptions when smtp     servers are able to negotiate starttls but fail to     respond properly. A man-in-the-middle attacker can     exploit this issue to bypass TLS protections via a     'StartTLS stripping attack.' (CVE-2016-0772)

  - An HTTP request injection vulnerability exists in Splunk     that permits leakage of authentication tokens. An     unauthenticated, remote attacker can exploit this to     access the Splunk REST API with the same rights as the     user.

Note that the Python vulnerabilities stated above do not affect the Splunk Enterprise 6.4.x versions, and the HTTP request injection vulnerability does not affect the Splunk Light versions.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3134-1 advisory.

    It was discovered that the smtplib library in Python did not return an error when StartTLS fails. A remote     attacker could possibly use this to expose sensitive information. (CVE-2016-0772)

    Rmi Rampin discovered that Python would not protect CGI applications from contents of the HTTP_PROXY     environment variable when based on the contents of the Proxy header from HTTP requests. A remote attacker     could possibly use this to cause a CGI application to redirect outgoing HTTP requests. (CVE-2016-1000110)

    Insu Yun discovered an integer overflow in the zipimporter module in Python that could lead to a heap-     based overflow. An attacker could use this to craft a special zip file that when read by Python could     possibly execute arbitrary code. (CVE-2016-5636)

    Guido Vranken discovered that the urllib modules in Python did not properly handle carriage return line     feed (CRLF) in headers. A remote attacker could use this to craft URLs that inject arbitrary HTTP headers.
    This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2016-5699)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Security Fix(es) :

  - It was discovered that the Python CGIHandler class did     not properly protect against the HTTP_PROXY variable     name clash in a CGI context. A remote attacker could     possibly use this flaw to redirect HTTP requests     performed by a Python CGI script to an     attacker-controlled proxy via a malicious HTTP request.
    (CVE-2016-1000110)

  - It was found that Python's smtplib library did not     return an exception when StartTLS failed to be     established in the SMTP.starttls() function. A man in     the middle attacker could strip out the STARTTLS command     without generating an exception on the Python SMTP     client application, preventing the establishment of the     TLS layer. (CVE-2016-0772)

  - It was found that the Python's httplib library (used by     urllib, urllib2 and others) did not properly check     HTTPConnection.putheader() function arguments. An     attacker could use this flaw to inject additional     headers in a Python application that allowed user     provided header names or values. (CVE-2016-5699)

This DLA fixes a a problem parsing x509 certificates, an pickle integer overflow, and some other minor issues :

CVE-2016-0772

The smtplib library in CPython does not return an error when StartTLS fails, which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between the client and the registry to block the StartTLS command, aka a 'StartTLS stripping attack.'

CVE-2016-5636

Integer overflow in the get_data function in zipimport.c in CPython allows remote attackers to have unspecified impact via a negative data size value, which triggers a heap-based buffer overflow.

CVE-2016-5699

CRLF injection vulnerability in the HTTPConnection.putheader function in urllib2 and urllib in CPython allows remote attackers to inject arbitrary HTTP headers via CRLF sequences in a URL.

CVE-2018-20406

Modules/_pickle.c has an integer overflow via a large LONG_BINPUT value that is mishandled during a 'resize to twice the size' attempt.
This issue might cause memory exhaustion, but is only relevant if the pickle format is used for serializing tens or hundreds of gigabytes of data.

CVE-2019-5010

NULL pointer dereference using a specially crafted X509 certificate.

For Debian 8 'Jessie', these problems have been fixed in version 3.4.2-1+deb8u2.

We recommend that you upgrade your python3.4 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for python fixes the following issues :

Security issues fixed :

CVE-2016-0772: smtplib vulnerability opens startTLS stripping attack (bsc#984751)

CVE-2016-5636: heap overflow when importing malformed zip files (bsc#985177)

CVE-2016-5699: incorrect validation of HTTP headers allow header injection (bsc#985348)

CVE-2016-1000110: HTTPoxy vulnerability in urllib, fixed by disregarding HTTP_PROXY when REQUEST_METHOD is also set (bsc#989523)

CVE-2019-5010: Fixed a denial-of-service vulnerability in the X509 certificate parser (bsc#1122191)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Guido Vranken reports :

HTTP header injection in urrlib2/urllib/httplib/http.client with newlines in header values, where newlines have a semantic consequence of denoting the start of an additional header line.

It was found that Python's httplib library (used urllib, urllib2 and others) did not properly check HTTP header input in HTTPConnection.putheader(). An attacker could use this flow to inject additional headers in a Python application that allows user provided header name or values. (CVE-2016-5699)

It was found that Python's smtplib library did not return an exception if StartTLS fails to establish correctly in the SMTP.starttls() function. An attacker with ability to launch an active man in the middle attack could strip out the STARTTLS command without generating an exception on the python SMTP client application, preventing the establishment of the TLS layer. (CVE-2016-0772)

A vulnerability was discovered in Python, in the built-in zipimporter.
A specially crafted zip file placed in a module path such that it would be loaded by a later 'import' statement could cause a heap overflow, leading to arbitrary code execution. (CVE-2016-5636)

Python was updated to fix three security issues.

The following vulnerabilities were fixed :

  - CVE-2016-0772: TLS stripping attack on smtplib     (bsc#984751)

  - CVE-2016-5636: zipimporter heap overflow (bsc#985177)

  - CVE-2016-5699: httplib header injection (bsc#985348)

This update also includes all upstream bug fixes and improvements in Python 2.7.12.

It also includes the following packaging changes :

  - reintroduce support for CA directory path

The following tracked packaging issues were fixed :

  - broken overflow checks (bsc#964182)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-1626 advisory.

    - Fix for CVE-2016-1000110 HTTPoxy attack     Resolves: rhbz#1359161
    - Fix for CVE-2016-0772 python: smtplib StartTLS stripping attack (rhbz#1303647)       Raise an error when STARTTLS fails (upstream patch)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for python3 to version 3.6.10 fixes the following issues :

CVE-2017-18207: Fixed a denial of service in Wave_read._read_fmt_chunk() (bsc#1083507).

CVE-2019-16056: Fixed an issue where email parsing could fail for multiple @ (bsc#1149955).

CVE-2019-15903: Fixed a heap-based buffer over-read in libexpat (bsc#1149429).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for python3 to version 3.6.10 fixes the following issues :

  - CVE-2017-18207: Fixed a denial of service in     Wave_read._read_fmt_chunk() (bsc#1083507).

  - CVE-2019-16056: Fixed an issue where email parsing could     fail for multiple @ (bsc#1149955).

  - CVE-2019-15903: Fixed a heap-based buffer over-read in     libexpat (bsc#1149429).

This update was imported from the SUSE:SLE-15:Update update project.

This update for python fixes the following issues :

  - CVE-2016-0772: smtplib vulnerability opens startTLS     stripping attack (bsc#984751)

  - CVE-2016-5636: heap overflow when importing malformed     zip files (bsc#985177)

  - CVE-2016-5699: incorrect validation of HTTP headers     allow header injection (bsc#985348)

  - CVE-2016-1000110: HTTPoxy vulnerability in urllib, fixed     by disregarding HTTP_PROXY when REQUEST_METHOD is also     set (bsc#989523)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
94932	Splunk Enterprise < 5.0.17 / 6.0.13 / 6.1.12 / 6.2.12 / 6.3.8 / 6.4.4 or Splunk Light < 6.5.0 Multiple Vulnerabilities	Nessus	CGI abuses	2016/11/17	2026/1/16	critical
95284	Ubuntu 14.04 LTS / 16.04 LTS : Python vulnerabilities (USN-3134-1)	Nessus	Ubuntu Local Security Checks	2016/11/23	2025/9/3	critical
93072	Scientific Linux Security Update : python on SL6.x, SL7.x i386/x86_64 (20160818) (httpoxy)	Nessus	Scientific Linux Local Security Checks	2016/8/22	2026/1/28	medium
122036	Debian DLA-1663-1 : python3.4 security update	Nessus	Debian Local Security Checks	2019/2/8	2024/6/21	critical
121570	SUSE SLES12 Security Update : python (SUSE-SU-2019:0223-1) (httpoxy)	Nessus	SuSE Local Security Checks	2019/2/4	2024/6/24	critical
91911	FreeBSD : Python -- HTTP Header Injection in Python urllib (a61374fc-3a4d-11e6-a671-60a44ce6887b)	Nessus	FreeBSD Local Security Checks	2016/7/1	2021/1/4	medium
92471	Amazon Linux AMI : python26 / python27,python34 (ALAS-2016-724)	Nessus	Amazon Linux Local Security Checks	2016/7/21	2026/1/30	critical
92595	openSUSE Security Update : python (openSUSE-2016-906)	Nessus	SuSE Local Security Checks	2016/7/28	2026/1/30	critical
93034	Oracle Linux 6 / 7 : python (ELSA-2016-1626)	Nessus	Oracle Linux Local Security Checks	2016/8/19	2026/1/28	medium
133036	SUSE SLED15 / SLES15 Security Update : python3 (SUSE-SU-2020:0114-1) (BEAST) (httpoxy)	Nessus	SuSE Local Security Checks	2020/1/17	2024/3/29	critical
133172	openSUSE Security Update : python3 (openSUSE-2020-86) (BEAST) (httpoxy)	Nessus	SuSE Local Security Checks	2020/1/22	2024/3/29	critical
93300	SUSE SLED12 / SLES12 Security Update : python (SUSE-SU-2016:2106-1) (httpoxy)	Nessus	SuSE Local Security Checks	2016/9/2	2026/1/27	critical

检测

插件搜索

critical

critical

medium

critical

critical

medium

critical

critical

medium

critical

critical

critical