CVE-2020-8445: Input Validation
In OSSEC-HIDS 2.7 through 3.5.0, the OSCleanMSG function in ossec-analysisd doesn't remove or encode terminal control characters or newlines from processed log messages. In many cases, those characters are later logged. Because newlines (\n) are permitted in messages processed by ossec-analysisd, it may be possible to inject nested events into the ossec log. Use of terminal control characters may allow obfuscating events or executing commands when viewed through vulnerable terminal emulators. This may be an unauthenticated remote attack for certain types and origins of logged data.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Mitigate risk by preventing untrusted log data (from origins affected by this issue) from being viewed in vulnerable terminal emulators; restrict/validate sources of log messages that end up in terminal displays or log viewers.
Event History
Frequently Asked Questions
What is the severity of CVE-2020-8445?
CVE-2020-8445 has a medium severity rating due to its potential to log unencoded terminal control characters and newlines.
How do I fix CVE-2020-8445?
To fix CVE-2020-8445, upgrade to a version of OSSEC-HIDS later than 3.5.0 which addresses the log message processing vulnerability.
What are the potential impacts of CVE-2020-8445?
The impacts of CVE-2020-8445 include the risk of malformed log entries that can disrupt log analysis and may obscure malicious activity.
Which versions of OSSEC are affected by CVE-2020-8445?
CVE-2020-8445 affects OSSEC-HIDS versions from 2.7 to 3.5.0.
Is CVE-2020-8445 exploitable in a default installation?
Yes, CVE-2020-8445 can be exploited in a default installation if log messages contain unencoded terminal control characters.