Snare for Linux Cross-Site Request Forgery I. BACKGROUND ---------------------- Snare for Linux provides a 'C2' or 'CAPP' style audit subsystem for the Linux operating system. It can be used as a standalone auditing tool for Linux, or can send data to the Snare Server for analysis and storage. II. DESCRIPTION ---------------------- A cross-site request forgery vulnerability (CSRF) has been identified in the web interface of Snare for Linux. The parameter "ChToken," which is designed to prevent CSRF, was not properly implemented in versions prior to 1.7.0. As a result, an attacker could force an authenticated user to execute unwanted actions on the web interface. III. AFFECTED PRODUCTS ---------------------- All versions of Snare for Linux prior to 1.7.0 are vulnerable. IV. ---------------------- Users should upgrade to version 1.7.0 of Snare for Linux. V. Credit ---------------------- This vulnerability was discovered by Andrew Brooks. VI. References ---------------------- CVE-2011-5250 http://rpmfind.net/linux/RPM/sourceforge/s/sn/snare/Snare%20for%20Linux/1.7.0/SnareLinux-1.7.0-0.i386.html VII. Timeline ---------------------- 7/11/11 - Vendor notification 8/09/11 - Fixed and closed