[R7] LCE 4.8.1 Fixes Multiple Vulnerabilities

The Log Correlation Engine (LCE) is potentially impacted by several vulnerabilities in OpenSSL (20160503), libpcre / PCRE, Libxml2, Handlebars, libcurl, and jQuery that were recently disclosed and fixed. Note that due to the time involved in doing a full analysis of each issue, Tenable has opted to upgrade the included versions of each library as a precaution, and to save time. These vulnerabilities may impact LCE and include:

• OpenSSL ASN.1 Encoder Negative Zero Value Handling Remote Memory Corruption
• OpenSSL crypto/evp/encode.c EVP_EncodeUpdate() Function Heap Buffer Overflow Weakness
• OpenSSL AES-NI CBC MAC Check Padding Oracle MitM Information Disclosure
• OpenSSL crypto/evp/evp_enc.c EVP_EncryptUpdate() Function Heap Buffer Overflow Weakness
• OpenSSL crypto/x509/x509_obj.c X509_NAME_oneline() Function ASN1 Strings Handling Out-of-bounds Read Memory Disclosure
• OpenSSL crypto/asn1/a_d2i_fp.c ASN.1 BIO Length Field Handling Memory Exhaustion Remote DoS
• Perl-Compatible Regular Expressions (PCRE) pcre_compile.c (*ACCEPT) Verb Handling Buffer Overflow
• Perl-Compatible Regular Expressions (PCRE) pcretest.c pchars() Function Out-of-bounds Read Weakness
• Perl-Compatible Regular Expressions (PCRE) pcre_compile.c compile_branch() Function Invalid Pattern Fragment Handling Stack Corruption
• Perl-Compatible Regular Expressions (PCRE) pcretest.c Out-of-bounds Read Weakness
• Perl-Compatible Regular Expressions (PCRE) pcre_compile.c pcre_compile2() Function Duplicate Named Group Nested Back Reference Handling Heap Buffer Overflow
• Libxml2 parser.c xmlParseElementDecl() / xmlParseConditionalSections() Functions Out-of-bounds Read Issue
• Libxml2 Multiple Functionality Format Strings
• Libxml2 HTMLparser.c htmlParseNameComplex() Function HTML File Encoding Detection Failure
• Libxml2 parser.c xmlStringLenDecodeEntities() Function Unspecified XML External Entity (XXE) Injection Issue
• Libxml2 xmlregexp.c xmlFAParseCharRange() Function Heap Buffer Overflow
• Libxml2 parser.c xmlParseStartTag2() Function Heap Use-after-free
• Libxml2 parser.c xmlParseNCNameComplex() Function Heap Use-after-free
• Libxml2 xmlstring.c xmlStrncatNew() Function Heap Buffer Overflow
• Libxml2 HTMLparser.c htmlParseSystemLiteral() / htmlParsePubidLiteral() Functions Heap Buffer Overflow
• Libxml2 xmlsave.c xmlBufAttrSerializeTxtContent() Function Recover Mode XML Content Handling Out-of-bounds Read Issue
• Libxml2 parser.c Multiple Function Recursive xmlStringDecodeEntities() Call Handling Stack Overflow DoS
• Libxml2 uri.c xmlParse3986Port() Function Port Argument Handling Integer Overflow Unspecified Issue
• Libxml2 HTMLparser.c htmlParseName() / htmlParseNameComplex() Functions Out-of-bounds Read Issue
• Libxml2 parser.c xmlParserEntityCheck() Function Recovery Mode XML Content Parsing Recursion DoS
• Libxml2 parser.c xmlParseEndTag2() Function Out-of-bounds Read Issue
• Libxml2 parserInternals.c xmlNextChar() Function Out-of-bounds Read Issue
• Handlebars lib/handlebars/utils.js Template Unquoted Attributes Improper Escaping XSS Weakness
• cURL / libcurl lib/multi.c close_all_connections() Function Easy Handle Handling Use-after-free Issue
• cURL / libcurl lib/vtls/vtls.c TLS Session Resumption Client Certificate Validation Bypass
• cURL / libcurl lib/vtls/vtls.c Curl_ssl_config_matches() Function TLS Connection Reuse Cross-realm Information Disclosure
• jQuery Core ajax/script.js Third-party Text Handling XSS

Tenable's Log Correlation Engine (LCE) was found to be impacted by an authenticated stored cross-site scripting (XSS) issue reported to us by Kaustubh Padwad and discovered internally. Tenable thanks him for privately reporting the issue to us.

[R5 Update] LCE was also found to be vulnerable to a second authenticated stored cross-site scripting (XSS) issue found internally by Rich Walchuck and was inadvertently left out of the advisory at publication. This is designated as LCE-4806 for tracking purposes.

Please note that Tenable strongly recommends that LCE be installed on a subnet that is not Internet addressable.