CVE-2020-8447: 
OSSEC vulnerability analysis and mitigation

CVE-2020-8447 affects OSSEC-HIDS versions 2.7 through 3.5.0. The vulnerability exists in the server component responsible for log analysis (ossec-analysisd), which is susceptible to a use-after-free vulnerability during the processing of syscheck formatted messages. These messages are received from authenticated remote agents and delivered to the analysisd processing queue by ossec-remoted (NVD, Debian Tracker).

The vulnerability occurs in the OS_ReadMSG function where the syscheck decoder frees the lf->full_log pointer and replaces existing lf->log and lf->full_log pointers with pointers to new messages. When subsequent processing rules access the lf->hostname or lf->program_name fields set by OS_CleanMSG, they access memory of a freed heap chunk previously containing lf->full_log. The bug was introduced in commit 8672fa0 from November 18, 2006 (GitHub Issue).

If exploited, this vulnerability could lead to accessing freed heap memory when processing rules access the hostname or program_name fields. This may potentially result in an out-of-bounds read of heap memory if the area pointed to after the syscheck decoder free isn't null terminated (GitHub Issue).

The vulnerability is exploitable through an authenticated client via ossec-remoted. The attacker needs only to write a valid syscheck message that will have the program_name or hostname set during OS_CleanMSG processing (GitHub Issue).

The issue was addressed in OSSEC version 3.6.0. Users should upgrade to this version or later to mitigate the vulnerability. A suggested fix involves modifying the syscheck decoder to use os_strdup for lf->hostname and lf->program_name before freeing full_log (Gentoo Security).

The vulnerability was rated as medium severity in the security audit findings of OSSEC-HIDS. It was part of a broader security audit that uncovered multiple vulnerabilities in the software (GitHub Issue).