CVE-2020-8448 : In OSSEC-HIDS 2.7 through 3.5.0, the server component responsible for log analysis (ossec-analysisd) is vulnerable to a

In OSSEC-HIDS 2.7 through 3.5.0, the server component responsible for log analysis (ossec-analysisd) is vulnerable to a denial of service (NULL pointer dereference) via crafted messages written directly to the analysisd UNIX domain socket by a local user.

Published 2020-01-30 01:15:11

Updated 2022-09-12 18:43:36

Source MITRE

View at NVD, CVE.org

Vulnerability category: Memory CorruptionDenial of service

Exploit prediction scoring system (EPSS) score for CVE-2020-8448

EPSS FAQ

0.04%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 6 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2020-8448

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
2.1	LOW	AV:L/AC:L/Au:N/C:N/I:N/A:P	3.9	2.9	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: None Availability Impact: Partial
5.5	MEDIUM	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	1.8	3.6	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High

References for CVE-2020-8448

https://www.ossec.net/

OSSEC - World's Most Widely Used Host Intrusion Detection System - HIDS
Vendor Advisory

CVEs referencing this url
https://security.gentoo.org/glsa/202007-33

OSSEC: Multiple vulnerabilities (GLSA 202007-33) — Gentoo security
Third Party Advisory

CVEs referencing this url
https://github.com/ossec/ossec-hids/issues/1815

CVE-2020-8448: analysisd: OS_CleanMSG segfault processing invalid msg location. · Issue #1815 · ossec/ossec-hids · GitHub
Exploit;Third Party Advisory
https://github.com/ossec/ossec-hids/issues/1821

OSSEC-HIDS Security Audit Findings · Issue #1821 · ossec/ossec-hids · GitHub
Third Party Advisory

CVEs referencing this url

Products affected by CVE-2020-8448

Ossec » Ossec
Versions from including (>=) 2.7 and up to, including, (<=) 3.5.0
cpe:2.3:a:ossec:ossec:*:*:*:*:*:*:*:*
Matching versions

Vulnerability Details : CVE-2020-8448

Exploit prediction scoring system (EPSS) score for CVE-2020-8448

CVSS scores for CVE-2020-8448

CWE ids for CVE-2020-8448

References for CVE-2020-8448

Products affected by CVE-2020-8448