CVE-2014-4326 Elasticsearch Logstash Remote Command Execution Vulnerability (ESA-2014-02)

ElasticSearch Logstash is an open source, server-side data processing pipeline that ingests data from a multitude of sources simultaneously, transforms it, and then sends it to your favorite 'stash'.

Logstash 1.4.1 and prior, when configured to use the Zabbix or Nagios outputs, allows an attacker with access to send crafted events to Logstash inputs to cause Logstash to execute OS commands.

Affected Versions:
ElasticSearch Logstash versions prior to 1.4.2 QID Detection Logic (Authenticated):
This QID checks for the installed Logstash package.

A remote attacker could exploit this vulnerability to execute arbitrary commands via a crafted event.

Customers are advised to upgrade to the latest version of Logstash. Refer to Logstash Downloads for more information.

Patch:
Following are links for downloading patches to fix the vulnerabilities:

ESA-2014-02 (Elasticsearch Logstash )