Splunk response to SSLv3 "POODLE" vulnerability (CVE-2014-3566)

Advisory ID: SP-CAAANKE

CVE ID: CVE-2014-3566

Published: 2014-10-14

Last Update: 2014-12-23

CVSSv3.1 Score: 5.4,

CVSSv3.1 Vector: -

CWE: -

Bug ID: -

Description

Splunk Enterprise response to SSLv3 “POODLE” vulnerability (CVE-2014-3566)
Hunk response to SSLv3 “POODLE” vulnerability (CVE-2014-3566)
Splunk Cloud response to SSLv3 “POODLE” vulnerability (CVE-2014-3566)
Splunk MINT response to SSLv3 “POODLE” vulnerability (CVE-2014-3566)
Splunk Storm response to SSLv3 “POODLE” vulnerability (CVE-2014-3566)
Splunk App for Stream response to SSLv3 “POODLE” vulnerability (CVE-2014-3566)
Splunk App for VMware response to SSLv3 “POODLE” vulnerability (CVE-2014-3566)
Splunk App for NetApp Data ONTAP response to SSLv3 “POODLE” vulnerability (CVE-2014-3566)

Splunk will update this advisory as additional information becomes available.

At the time of this announcement, Splunk is not aware of any cases where this vulnerability has been actively exploited. Previous Product Security Announcements can be found on our Splunk Product Security Portal. Use SPL numbers when referencing issues in communication with Splunk. If there is no CVE Identifier listed with a vulnerability, it will be added once it is assigned by a CVE Numbering Authority. To standardize the calculation of severity scores for each vulnerability, when appropriate, Splunk uses Common Vulnerability Scoring System version 2.

Affected Products and Components

Splunk Enterprise
- Affected versions: All versions of Splunk Enterprise 6.2.x, 6.1.x, 6.0.x, and 5.0.x.
- Affected components: Search heads, heavy forwarders, universal forwarders, indexers, and KV Store/MongoDB.
Hunk
- Affected versions: All versions of Hunk 6.2.x, 6.1.x and 6.0.x.
Splunk Cloud
Splunk MINT
Splunk Storm
Splunk App for Stream
Splunk App for VMware
Splunk App for NetApp Data ONTAP
Mitigation and Upgrades
Splunk Enterprise and Hunk 6.2.0
Hunk 6.2.0 and Splunk Enterprise 6.2.0 introduce the sslVersions attribute to permit administrators to manage SSL/TLS protocol support parameters on Splunk Web, Indexers, and Splunkd management ports. Additionally, SSLv3 support in 6.2.0 contains TLS_FALLBACK_SCSV to further mitigate the POODLE attack. Splunk Enterprise 6.2.0 and Hunk 6.2.0 have SSLv3 enabled by default. SSLv3 can be removed after all legacy installations are upgraded to 6.2.0. Please review Known Issues prior to upgrading.

Splunk Enterprise 6.1.5

Splunk Enterprise 6.1.5 addresses SSLv3 issues via a separate security advisory.

Splunk Enterprise 6.0.7 and 5.0.11

Splunk Enterprise 6.0.7 and 5.0.11 address SSLv3 issues via a separate security advisory.

Splunk Enterprise 6.1.x, 6.0.x, 5.0.x, and Hunk 6.1.x, 6.0.x

Splunk Web: Systems running Splunk Web where users access the web over untrusted networks are the most at risk. Customers that have deployed Splunk Web via a trusted network or behind a TLS-enforcing reverse proxy are not at risk. Splunk Web is installed on port 8000 in a default installation. The default SSL configuration of Splunk Enterprise and Hunk supports TLS connections.

SSLv3 is used within Splunk deployments as a transport security protocol.

In order to perform the attack, an attacker must intercept and modify traffic between the client and the server. The attacker must also be able to induce the client to generate specific known requests to the server.

Browser mitigations: Affected customers can disable SSLv3 in Internet Explorer (via Internet Options), Chrome (command line argument of –ssl-version-min=tls1), and Firefox.

Splunk components: Universal Forwarders, Indexers and KV Store/MongoDB will also show in vulnerability scans as able to negotiate SSLv3. However, they do not permit an attacker to generate the necessary arbitrary requests to execute an attack.

Vulnerability Descriptions and Ratings

Splunk Enterprise response to SSLv3 “POODLE” vulnerability (CVE-2014-3566)

Description: Splunk Enterprise versions 6.2.x, 6.1.x, 6.0.x, and 5.0.x support SSL/TLS security for end-user access to Splunk Web, Splunk management communication, and forwarders. Please review Mitigation and Upgrades in order to understand and mitigate this issue.

CVSS Base Score 5.4

CVSS Impact Subscore 6.4