CVE-2011-2779

Vulnerability

The Windows Event Log SmartConnector in HP ArcSight Connector Appliance before version 6.1 (specifically v6.0.0.60023.2 and possibly earlier) creates exported report files with world-writable permissions. This allows any local user to modify or delete these files, potentially altering log data. The exported report files are created with a default name and are world-writable [1].

Exploitation

An attacker with local access to the ArcSight Connector Appliance can locate the exported report files (which are world-writable) and modify or delete them. No special privileges are required beyond local user access. The attacker can change the contents of the report file, including injecting malicious content if the file is later imported and edited (as part of an XSS attack, but that is a separate vulnerability CVE-2011-0770). For this CVE, the exploitation simply involves writing to the file.

Impact

A local attacker can change or delete log data by modifying the exported report files. This could lead to loss of integrity of log data, potentially covering up malicious activities or causing denial of service by deleting important logs. The attacker does not gain elevated privileges but can corrupt data.

Mitigation

HP released ArcSight Connector Appliance version 6.1 to address this vulnerability. Users should upgrade to version 6.1 or later. If upgrading is not possible, restrict local access to the appliance and ensure that exported report files are stored in a secure location with appropriate permissions. No workaround is mentioned in the reference.