FreeBSD : elasticsearch -- security fix for shared file-system repositories (23232028-1ba4-11e5-b43d-002590263bf5)

high Nessus Plugin ID 84410

Language:

Synopsis

The remote FreeBSD host is missing a security-related update.

Description

Elastic reports :

Vulnerability Summary: All Elasticsearch versions from 1.0.0 to 1.5.2 are vulnerable to an attack that uses Elasticsearch to modify files read and executed by certain other applications.

Remediation Summary: Users should upgrade to 1.6.0. Alternately, ensure that other applications are not present on the system, or that Elasticsearch cannot write into areas where these applications would read.

Solution

Update the affected package.

Plugin Details

Severity: High

ID: 84410

File Name: freebsd_pkg_232320281ba411e5b43d002590263bf5.nasl

Version: 2.6

Type: local

Family: FreeBSD Local Security Checks

Published: 6/26/2015

Updated: 1/6/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: Medium

Base Score: 6

Vector: CVSS2#AV:N/AC:M/Au:S/C:P/I:P/A:P

CVSS v3

Risk Factor: High

Base Score: 7.5

Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Vulnerability Information

CPE: p-cpe:/a:freebsd:freebsd:elasticsearch, cpe:/o:freebsd:freebsd

Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info

Patch Publication Date: 6/26/2015

Vulnerability Publication Date: 6/9/2015

Reference Information

CVE: CVE-2015-4165

Detections

Analytics