name: Detect Baron Samedit CVE-2021-3156
id: 93fbec4e-0375-440c-8db3-4508eca470c4
version: 1
date: '2021-01-27'
author: Shannon Davis, Splunk
type: batch
datamodel: []
description: This search detects the heap-based buffer overflow of sudoedit
search: '`linux_hosts` | search "sudoedit -s \\" | `detect_baron_samedit_cve_2021_3156_filter`'
how_to_implement: Splunk Universal Forwarder running on Linux systems, capturing logs
  from the /var/log directory. The vulnerability is exposed when a non privledged
  user tries passing in a single \ character at the end of the command while using
  the shell and edit flags.
known_false_positives: unknown
references:
- https://blog.qualys.com/vulnerabilities-research/2021/01/26/cve-2021-3156-heap-based-buffer-overflow-in-sudo-baron-samedit
tags:
  analytic_story:
  - Baron Samedit CVE-2021-3156
  asset_type: Endpoint
  cis20:
  - CIS 8
  - CIS 12
  - CIS 16
  kill_chain_phases:
  - Exploitation
  mitre_attack_id:
  - T1068
  nist:
  - DE.CM
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  security_domain: endpoint
