Software Engineering Institute

CWE-295: Improper Certificate Validation - CVE-2015-2902

The ArcSight SmartConnector fails to validate the certificate of the upstream Logger device it is reporting logs to. An eavesdropper can perform a man-in-the-middle attack against log traffic.

CWE-259: Use of Hard-coded Password - CVE-2015-2903

Use of a default password (and no mechanism for changing it) in the CWSAPI SOAP service provided by ArcSight allows an an attacker to gain administrator credentials.

A remote attacker may be able to utilize a man-in-the-middle attack to read SSL-encrypted log traffic. A remote attacker may use the hard-coded password to gain root access to the device.

Apply an update

HP has released ArcSight SmartConnector 7.1.6, which addresses these issues. Affected users should update to version 7.1.6 or later as soon as possible.