CVE-2011-2779: Windows Event Log SmartConnector in HP ArcSight Connector Appliance before 6.1 uses world-writable permissi...

Security readout for executives and security teams

This flaw weakens trust in exported security logs from HP ArcSight Connector Appliance before 6.1. Local users could modify or delete report files because they were created with world-writable permissions. The main business risk is loss or manipulation of evidence, not confirmed remote compromise. Exposure is most likely limited to environments still running HP ArcSight Connector Appliance versions before 6.1 with Windows Event Log SmartConnector enabled and local user access to exported report files. Prioritize if legacy ArcSight appliances still support investigations, compliance evidence, or incident response. The risk is evidence tampering by local users, so urgency depends on deployment age, access controls, and reliance on exported reports. Mitigation focus: Identify any ArcSight Connector Appliance deployments older than 6.1.; Check current vendor guidance before changing production connectors.; Move affected appliances to a fixed or supported version where available..

Prepared

Jun 27, 2026, 18:09 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.