From owner-svn-ports-all@freebsd.org Fri Jun 26 04:35:46 2015 Return-Path: Delivered-To: svn-ports-all@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id D148F98D36D; Fri, 26 Jun 2015 04:35:46 +0000 (UTC) (envelope-from delphij@FreeBSD.org) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:1900:2254:2068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id B6D841952; Fri, 26 Jun 2015 04:35:46 +0000 (UTC) (envelope-from delphij@FreeBSD.org) Received: from svn.freebsd.org ([127.0.1.70]) by svn.freebsd.org (8.14.9/8.14.9) with ESMTP id t5Q4Zkgv056408; Fri, 26 Jun 2015 04:35:46 GMT (envelope-from delphij@FreeBSD.org) Received: (from delphij@localhost) by svn.freebsd.org (8.14.9/8.14.9/Submit) id t5Q4ZkKl056403; Fri, 26 Jun 2015 04:35:46 GMT (envelope-from delphij@FreeBSD.org) Message-Id: <201506260435.t5Q4ZkKl056403@svn.freebsd.org> X-Authentication-Warning: svn.freebsd.org: delphij set sender to delphij@FreeBSD.org using -f From: Xin LI Date: Fri, 26 Jun 2015 04:35:46 +0000 (UTC) To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r390615 - head/security/vuxml X-SVN-Group: ports-head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-ports-all@freebsd.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: SVN commit messages for the ports tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 26 Jun 2015 04:35:46 -0000 Author: delphij Date: Fri Jun 26 04:35:45 2015 New Revision: 390615 URL: https://svnweb.freebsd.org/changeset/ports/390615 Log: Document CVE-2014-3120, CVE-2014-6439, CVE-2015-1427, CVE-2015-3337, and CVE-2015-4165 (various Elasticsearch vulnerabilities). PR: ports/201008 Submitted by: Jason Unovitch Modified: head/security/vuxml/vuln.xml Modified: head/security/vuxml/vuln.xml ============================================================================== --- head/security/vuxml/vuln.xml Fri Jun 26 04:00:47 2015 (r390614) +++ head/security/vuxml/vuln.xml Fri Jun 26 04:35:45 2015 (r390615) @@ -57,6 +57,216 @@ Notes: --> + + elasticsearch -- security fix for shared file-system repositories + + + elasticsearch + 1.0.01.6.0 + + + + +

Elastic reports:

+
Vulnerability Summary: All Elasticsearch versions from 1.0.0 to + 1.5.2 are vulnerable to an attack that uses Elasticsearch to modify + files read and executed by certain other applications.
+
Remediation Summary: Users should upgrade to 1.6.0. Alternately, + ensure that other applications are not present on the system, or + that Elasticsearch cannot write into areas where these applications + would read.
+

+ + + + CVE-2015-4165 + ports/201008 + https://www.elastic.co/community/security + https://www.elastic.co/blog/elasticsearch-1-6-0-released + + + 2015-06-09 + 2015-06-26 + + + + + elasticsearch -- directory traversal attack with site plugins + + + elasticsearch + 1.4.5 + 1.5.01.5.2 + + + + +

Elastic reports:

+
Vulnerability Summary: All Elasticsearch versions prior to 1.5.2 + and 1.4.5 are vulnerable to a directory traversal attack that allows + an attacker to retrieve files from the server running Elasticsearch + when one or more site plugins are installed, or when Windows is the + server OS.
+
Remediation Summary: Users should upgrade to 1.4.5 or 1.5.2. Users + that do not want to upgrade can address the vulnerability by + disabling site plugins. See the CVE description for additional + options.
+

+ + + + CVE-2015-3337 + 74353 + https://www.elastic.co/community/security + https://www.elastic.co/blog/elasticsearch-1-5-2-and-1-4-5-released + https://www.exploit-db.com/exploits/37054/ + https://packetstormsecurity.com/files/131646/Elasticsearch-Directory-Traversal.html + http://www.securityfocus.com/archive/1/535385 + + + 2015-04-27 + 2015-06-26 + + + + + elasticsearch -- remote OS command execution via Groovy scripting engine + + + elasticsearch + 1.3.01.3.8 + 1.4.01.4.3 + + + + +

Elastic reports:

+
Vulnerability Summary: Elasticsearch versions 1.3.0-1.3.7 and + 1.4.0-1.4.2 have vulnerabilities in the Groovy scripting engine that + were introduced in 1.3.0. The vulnerability allows an attacker to + construct Groovy scripts that escape the sandbox and execute shell + commands as the user running the Elasticsearch Java VM.
+
Remediation Summary: Users should upgrade to 1.3.8 or 1.4.3. Users + that do not want to upgrade can address the vulnerability by setting + script.groovy.sandbox.enabled to false in elasticsearch.yml and + restarting the node.
+

+ + + + CVE-2015-1427 + 72585 + https://www.elastic.co/community/security + https://www.elastic.co/blog/elasticsearch-1-4-3-and-1-3-8-released + http://www.securityfocus.com/archive/1/archive/1/534689/100/0/threaded + https://packetstormsecurity.com/files/130368/Elasticsearch-1.3.7-1.4.2-Sandbox-Escape-Command-Execution.html + https://packetstormsecurity.com/files/130784/ElasticSearch-Unauthenticated-Remote-Code-Execution.html + + + 2015-02-11 + 2015-06-26 + + + + + elasticsearch -- cross site scripting vulnerability in the CORS functionality + + + elasticsearch + 1.4.0 + + + + +

Elastic reports:

+
Vulnerability Summary: Elasticsearch versions 1.3.x and prior have + a default configuration for CORS that allows an attacker to craft + links that could cause a user's browser to send requests to + Elasticsearch instances on their local network. These requests could + cause data loss or compromise.
+
Remediation Summary: Users should either set "http.cors.enabled" to + false, or set "http.cors.allow-origin" to the value of the server + that should be allowed access, such as localhost or a server hosting + Kibana. Disabling CORS entirely with the former setting is more + secure, but may not be suitable for all use cases.
+

+ + + + CVE-2014-6439 + 70233 + https://www.elastic.co/community/security + https://www.elastic.co/blog/elasticsearch-1-4-0-beta-released + https://packetstormsecurity.com/files/128556/Elasticsearch-1.3.x-CORS-Issue.html + http://www.securityfocus.com/archive/1/archive/1/533602/100/0/threaded + + + 2014-10-01 + 2015-06-26 + + + + + elasticsearch and logstash -- remote OS command execution via dynamic scripting + + + elasticsearch + 1.2.0 + + + logstash + 1.4.3 + + + + +

Elastic reports:

+
Vulnerability Summary: In Elasticsearch versions 1.1.x and prior, + dynamic scripting is enabled by default. This could allow an + attacker to execute OS commands.
+
Remediation Summary: Disable dynamic scripting.
+

+
Logstash 1.4.2 was bundled with Elasticsearch 1.1.1, which is + vulnerable to CVE-2014-3120. These binaries are used in + Elasticsearch output specifically when using the node protocol. + Since a node client joins the Elasticsearch cluster, the attackers + could use scripts to execute commands on the host OS using the node + client's URL endpoint. With 1.4.3 release, we are packaging Logstash + with Elasticsearch 1.5.2 binaries which by default disables the + ability to run scripts. This also affects users who are using the + configuration option embedded=>true in the Elasticsearch output + which starts a local embedded Elasticsearch cluster. This is + typically used in development environment and proof of concept + deployments. Regardless of this vulnerability, we strongly recommend + not using embedded in production.
+
Note that users of transport and http protocol are not vulnerable + to this attack.
+

+ + + + CVE-2014-3120 + 67731 + https://www.elastic.co/community/security + https://www.elastic.co/blog/elasticsearch-1-2-0-released + https://www.elastic.co/blog/logstash-1-4-3-released + https://www.exploit-db.com/exploits/33370/ + http://bouk.co/blog/elasticsearch-rce/ + http://www.rapid7.com/db/modules/exploit/multi/elasticsearch/script_mvel_rce + https://www.found.no/foundation/elasticsearch-security/#staying-safe-while-developing-with-elasticsearch + + + 2014-05-22 + 2015-06-26 + + + logstash -- Directory traversal vulnerability in the file output plugin