PT-2017-13657 · Elastic · Logstash-Bin+1

Michael Orlitzky · Published 2017-09-25 · Updated 2019-10-03 · CVE-2017-14730

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions logstash-bin versions prior to 5.5.3 logstash-bin versions 5.6.x prior to 5.6.1

Description The issue allows local users to gain privileges by creating a hard link in a user-writable directory tree. This is due to the init script having "chown -R" calls, which can be leveraged by users with access to a $LS USER account.

Recommendations For logstash-bin versions prior to 5.5.3, update to version 5.5.3 or later. For logstash-bin versions 5.6.x prior to 5.6.1, update to version 5.6.1 or later.

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2017-14730

Affected Products

Logstash

Logstash-Bin

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2017-14730 · Security Note
• https://osv.dev/vulnerability/CVE-2017-14730 · Vendor Advisory
• https://github.com/gentoo/gentoo/pull/5665 · Note
• https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=bbd6cb398c1740c68e9b1b78340c887c58c1fbda · Note
• https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=18f97c851c209f291b31ae7a902719f1c17c79fa · Note
• https://bugs.gentoo.org/628558 · Note