PT-2017-13657 · Elastic · Logstash-Bin+1

Michael Orlitzky · Publicado 2017-09-25 · Atualizado 2019-10-03 · CVE-2017-14730

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions logstash-bin versions prior to 5.5.3 logstash-bin versions 5.6.x prior to 5.6.1

Description The issue allows local users to gain privileges by creating a hard link in a user-writable directory tree. This is due to the init script having "chown -R" calls, which can be leveraged by users with access to a $LS USER account.

Recommendations For logstash-bin versions prior to 5.5.3, update to version 5.5.3 or later. For logstash-bin versions 5.6.x prior to 5.6.1, update to version 5.6.1 or later.

Correção

Incorrect Permission

Enumeração de Fraquezas

CWE-732

Identificadores relacionados

CVE-2017-14730

Produtos afetados

Logstash

Logstash-Bin

Referências · 6

• https://github.com/gentoo/gentoo/pull/5665 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-14730 · Nota de Segurança
• https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=bbd6cb398c1740c68e9b1b78340c887c58c1fbda · Nota
• https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=18f97c851c209f291b31ae7a902719f1c17c79fa · Nota
• https://osv.dev/vulnerability/CVE-2017-14730 · Aviso do Fabricante
• https://bugs.gentoo.org/628558 · Nota