Denial-of-Service via Unbounded Audit Logging in Nozomi Networks Product

Executive Summary

This vulnerability is a denial-of-service issue found in the audit logging functionality of certain systems. It occurs because there is no size limit on the input recorded into audit entries, allowing an attacker to submit very large inputs.

An unauthenticated attacker can exploit this by sending excessively large requests that get recorded in audit logs, which can exhaust the available disk space and cause the system to become inoperable.

Useful 0 Not Useful 0

Impact Analysis

The impact of this vulnerability is that an attacker can cause a denial-of-service condition by filling up the disk space with large audit log entries.

This can render the affected system inoperable, potentially disrupting business operations and causing downtime.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves unbounded resource allocation in audit logging, where excessively large input is recorded into audit entries, potentially exhausting disk space.

To detect this vulnerability on your system, you can check the version of the Guardian or CMC software running on your devices. Versions prior to 26.2.0 are vulnerable.

Additionally, monitoring disk usage on the system for unusual or rapidly increasing consumption in audit log directories can help identify exploitation attempts.

Suggested commands include:

• Check software version: run the command or check the system interface to verify if the version is older than 26.2.0.
• Monitor disk usage: use commands like 'df -h' to check disk space and 'du -sh /path/to/audit/logs' to check the size of audit log directories.
• Inspect audit logs for unusually large entries or rapid growth.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include upgrading the Guardian or CMC software to version 26.2.0 or later, where the vulnerability has been fixed.

If upgrading is not immediately possible, restrict access to the web management interface by applying internal firewall rules to limit exposure to unauthenticated attackers.

Useful 0 Not Useful 0