Bug 200758

Summary: textproc/elasticsearch: Security vulnerability CVE-2015-4165
Product: Ports & Packages Reporter: Kubilay Kocak <koobs>
Component: Individual Port(s)Assignee: Xin LI <delphij>
Status: Closed DUPLICATE    
Severity: Affects Only Me CC: delphij, olgeni, ports-secteam, venture37
Priority: --- Keywords: needs-patch, security
Version: LatestFlags: bugzilla: maintainer-feedback? (tj)
Hardware: Any   
OS: Any   
URL: http://www.securityfocus.com/archive/1/535727/30/0/threaded

Description Kubilay Kocak freebsd_committer freebsd_triage 2015-06-10 11:31:27 UTC 
Elasticsearch versions 1.0.0 - 1.5.2 are vulnerable to an engineered attack on other applications on the system. The snapshot API may be used indirectly to place snapshot metadata files into locations that are writeable by the user running the Elasticsearch process. It is possible to create a file that another application could read and take action on, such as code execution.

This vulnerability requires several conditions to be exploited. There must be some other application running on the system that would read Lucene files and execute code from them. That application must also be accessible to the attacker, e.g. over the network. Lastly, the Java VM running the Elasticsearch process must be able to write into a location that the other application will read and potentially execute.
Comment 1 Kubilay Kocak freebsd_committer freebsd_triage 2015-06-11 03:27:53 UTC 
*** Bug 200780 has been marked as a duplicate of this bug. ***
Comment 2 Jimmy Olgeni freebsd_committer freebsd_triage 2015-06-21 16:00:36 UTC 
1.6.0 upgrade in #201008.
Comment 3 Xin LI freebsd_committer freebsd_triage 2015-06-30 18:05:22 UTC 
Maintainer timed out -- closing as duplicated by 201008.

*** This bug has been marked as a duplicate of bug 201008 ***