PT-2011-2282 · Balabit · Syslog-Ng

Steven Chamberlain · Publicado 2011-01-28 · Atualizado 2020-05-19 · CVE-2011-0343

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Média

Vetor base

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Balabit syslog-ng versions 2.0, 3.0, 3.1, 3.2 OSE and PE

Description The issue is related to improper cast operations when running on certain operating systems, resulting in the creation of log files with insecure permissions. This allows local users to read and write to these log files.

Recommendations For Balabit syslog-ng versions 2.0, 3.0, 3.1, 3.2 OSE and PE, consider changing the default permissions to a more secure setting to prevent unauthorized access to log files.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2011-0343

OPENSUSE-SU-2024:10493-1

Produtos afetados

Syslog-Ng

Referências · 9

• https://nvd.nist.gov/vuln/detail/CVE-2011-0343 · Nota de Segurança
• https://lists.balabit.com/pipermail/syslog-ng-announce/2011-January/000101.html · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2011-0343 · Aviso do Fabricante
• http://securityfocus.com/archive/1/515955/100/0/threaded · Nota
• https://lists.balabit.com/pipermail/syslog-ng-announce/2011-January/000102.html · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-0343 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2011-0343 · Aviso do Fabricante
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=608491 · Correção
• http://securityfocus.com/bid/45988 · Nota