CVEvulnerability
CVE-2017-6972
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2017-03-22
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 9.8 CRITICAL — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-273
Description
AlienVault USM and OSSIM before 5.3.7 and NfSen before 1.3.8 have an error in privilege dropping and unnecessarily execute the NfSen Perl code as root, aka AlienVault ID ENG-104945, a different vulnerability than CVE-2017-6970 and CVE-2017-6971.
Affected configurations
• alienvault ossim (<= 5.3.6)
• alienvault unified security management (<= 5.3.6)
• nfsen nfsen (<= 1.3.7)
Related
Weakness · CWE (1)
- CWE-273 Improper Check for Dropped Privileges weakness
References
- http://www.securityfocus.com/bid/97016 Third Party Advisory, VDB Entry
- https://sourceforge.net/p/nfsen/news/2017/01/nfsen-138-released---security-fix/ Third Party Advisory
- https://www.alienvault.com/forums/discussion/8698 Vendor Advisory
- https://www.exploit-db.com/exploits/42314/ www.exploit-db.com
- http://www.securityfocus.com/bid/97016 Third Party Advisory, VDB Entry
- https://sourceforge.net/p/nfsen/news/2017/01/nfsen-138-released---security-fix/ Third Party Advisory
- https://www.alienvault.com/forums/discussion/8698 Vendor Advisory
- https://www.exploit-db.com/exploits/42314/ www.exploit-db.com