CVE-2017-14730 — HIGH (7.8)

Vulnerability Description

The init script in the Gentoo app-admin/logstash-bin package before 5.5.3 and 5.6.x before 5.6.1 has "chown -R" calls for user-writable directory trees, which allows local users to gain privileges by leveraging access to a $LS_USER account for creation of a hard link.

CVSS Score

7.8

HIGH

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
Elasticsearch	Logstash	5.0.0
Gentoo	Linux	-

Related Weaknesses (CWE)

CWE-732

References

https://bugs.gentoo.org/628558Third Party Advisory
https://github.com/gentoo/gentoo/pull/5665Third Party Advisory
https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=18f97c851c209f291b31ae7a902Third Party Advisory
https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=bbd6cb398c1740c68e9b1b78340Third Party Advisory
https://bugs.gentoo.org/628558Third Party Advisory
https://github.com/gentoo/gentoo/pull/5665Third Party Advisory
https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=18f97c851c209f291b31ae7a902Third Party Advisory
https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=bbd6cb398c1740c68e9b1b78340Third Party Advisory

FAQ

What is CVE-2017-14730?

CVE-2017-14730 is a vulnerability with a CVSS score of 7.8 (HIGH). The init script in the Gentoo app-admin/logstash-bin package before 5.5.3 and 5.6.x before 5.6.1 has "chown -R" calls for user-writable directory trees, which allows local users to gain privileges by ...

How severe is CVE-2017-14730?

CVE-2017-14730 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2017-14730?

Check the references section above for vendor advisories and patch information. Affected products include: Elasticsearch Logstash, Gentoo Linux.