PT-2017-12044 · Elastic · Packetbeat

Teppei Fukuda · Published 2017-12-08 · Updated 2022-02-15 · CVE-2017-11480

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Packetbeat versions prior to 5.6.4 Packetbeat version 6.0.0

Description The issue is a denial of service flaw in the PostgreSQL protocol handler. If Packetbeat is listening for PostgreSQL traffic and a user is able to send arbitrary network traffic to the monitored port, the attacker could prevent Packetbeat from properly logging other PostgreSQL traffic. A local attacker can cause a panic due to an out of bounds read if they are able to send arbitrary traffic to a monitored port.

Recommendations For Packetbeat versions prior to 5.6.4, update to version 5.6.4 or later to resolve the issue. For Packetbeat version 6.0.0, update to a version later than 6.0.0 to resolve the issue. As a temporary workaround, consider restricting access to the monitored port to minimize the risk of exploitation.

Fix

Improper Resource Release

Weakness Enumeration

CWE-404

Related Identifiers

CVE-2017-11480

GHSA-9Q3G-M353-CP4P

GO-2022-0643

Affected Products

Packetbeat

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2017-11480 · Security Note
• https://osv.dev/vulnerability/GHSA-9q3g-m353-cp4p · Vendor Advisory
• https://discuss.elastic.co/t/beats-5-6-4-security-update/106739 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-11480 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-0643 · Vendor Advisory
• https://github.com/elastic/beats · Note
• https://github.com/elastic/beats/pull/5480 · Note
• https://github.com/elastic/beats/pull/5457 · Note
• https://github.com/elastic/beats/commit/aeca65779d573976981587ca1d1461399e1b59dd · Note
• https://github.com/elastic/beats/pull/5479 · Note
• https://pkg.go.dev/vuln/GO-2022-0643 · Note