High · published October 29, 2025
⚠️ A crafty agent message can bring down your Wazuh analysisd service! This sneaky misstep in the fim_alert() implementation is like a trusted friend pulling the rug out from under you. 😲 Picture a restaurant where the chef receives an order but fails to double-check the ingredients list before starting to cook. If a rogue customer places a faulty order, it could lead to a kitchen disaster, causing the entire restaurant to halt operations! This vulnerability allows an attacker to send a specially crafted message to the Wazuh manager, crashing the analysisd service. The result? Your threat detection capabilities could be knocked offline, leaving your systems vulnerable to real threats during the downtime. Ouch!
Picture a restaurant where the chef receives an order but fails to double-check the ingredients list before starting to cook. If a rogue customer places a faulty order, it could lead to a kitchen disaster, causing the entire restaurant to halt operations! Prior to version 4.11.0, the fim_alert() function in Wazuh did not check if the return value of ctime_r was NULL before calling strdup() on it, leading to potential crashes.
This vulnerability allows an attacker to send a specially crafted message to the Wazuh manager, crashing the analysisd service. The result? Your threat detection capabilities could be knocked offline, leaving your systems vulnerable to real threats during the downtime. Ouch! To mitigate this vulnerability, upgrade your Wazuh platform to version 4.11.0 or later immediately. Regularly review your configurations and monitor for any messages that could exploit this flaw to ensure your systems remain safe. 🚀 You've got this! With a quick update, you'll have your analysisd service up and running smoothly in no time! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| wazuh/wazuh | < 4.11.0 | 4.11.0 |