TippingPoint Zero Day Initiative

AlienVault OSSIM av-centerd Util.pm remote_task Remote Code Execution Vulnerability

ZDI-14-295: August 14th, 2014


CVSS Score

Affected Vendors

Affected Products

Vulnerability Details

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of AlienVault OSSIM. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the av-centerd SOAP service. The issue lies in the handling of remote_task requests due to a failure to safely sanitize user data before executing a command. An attacker could leverage this vulnerability to execute code with root privileges.

Vendor Response

AlienVault has issued an update to correct this vulnerability. More details can be found at:

Disclosure Timeline

    2014-04-18 - Vulnerability reported to vendor
    2014-08-14 - Coordinated public release of advisory


This vulnerability was discovered by:
    HP Zero Day Initiative