SecBoard
Zurück zur CVE-Übersicht

CVE-2026-112335

MEDIUM(5.5)

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Risk Signal Score19/100 — NIEDRIG
  • CVSS 5.5 — Mittel

Erwähnungen (letzte 60 Tage)

Artikel

EPSS-Score

0.1%

Exploit-Wahrscheinlichkeit (30 Tage)

CVSS Score

5.5

Technische Schwere

Beschreibung

Wazuh agent from 1.0.0 before 4.14.9 contains a stack-based buffer overflow in the logcollector snort-full log reader that miscalculates remaining buffer space in read_snortfull(). Attackers who write crafted multi-line content to a monitored snort-full log can overflow the 65,280-byte stack buffer, crashing the agent or overwriting an SEH handler on 32-bit Windows agents running as SYSTEM.

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Behobene Versionen

  • 4.14.9

Threat-Hunting-Queries

Detects attempts to write excessively long multi-line content to Snort full logs, which could indicate an attempt to trigger the buffer overflow. This query looks for log entries that exceed a typical line length for Snort logs, specifically targeting the 'snort-full' format.

Sentinel/Defender KQL

SecurityEvent
| where EventID == 4663 // Example: File System Object Access for log files
| where ObjectName contains ".log" and ObjectName contains "snort-full"
| where RenderedDescription contains "[Classification: "
| summarize MaxLineLength = max(strlen(RenderedDescription)) by Computer, ObjectName
| where MaxLineLength > 1024 // Adjust threshold based on normal Snort log line length
| project Computer, ObjectName, MaxLineLength

Splunk SPL

index=* sourcetype=snort:full
| rex field=_raw "(?<snort_line>.*)"
| eval line_length = len(snort_line)
| where line_length > 1024 // Adjust threshold based on normal Snort log line length
| stats max(line_length) as MaxLineLength by host, source
| where MaxLineLength > 1024

Sigma

title: Wazuh Agent Snort-Full Log Buffer Overflow Attempt
id: 00000000-0000-0000-0000-000000000001
status: experimental
description: Detects attempts to write excessively long multi-line content to Snort full logs, potentially indicating a buffer overflow attempt in Wazuh Agent's read_snortfull() function.
author: SecBoard
date: 2026/11/06
logsource:
  category: file_event
  product: windows
detection:
  selection:
    EventID: 4663 # Windows Security Event ID for file access
    TargetFilename|contains: ['.log', 'snort-full']
    Content|contains: '[Classification: '
  condition: selection | length(Content) > 1024 # Adjust threshold
  timeframe: 5m
  level: high

Elastic ES|QL

FROM logs
| WHERE event.category == "file"
| WHERE file.path LIKE "%.log" AND file.path LIKE "%snort-full%"
| WHERE message LIKE "[Classification: %"
| EVAL line_length = LENGTH(message)
| WHERE line_length > 1024 // Adjust threshold based on normal Snort log line length
| STATS max_line_length = MAX(line_length) BY host.name, file.path
| WHERE max_line_length > 1024

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Referenzen