PT-2012-1180 · Rsyslog+2 · Rsyslog+2
CVSS v2.0
7.5
Alta
| Vetor | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
rsyslog versions prior to 8.4.2
rsyslog versions 4.x prior to 4.6.6
rsyslog versions 5.x prior to 5.7.4
rsyslog versions 6.x prior to 6.1.4
Description
The issue is related to multiple vulnerabilities in the rsyslog package, which can be exploited remotely, potentially leading to breaches of confidentiality, integrity, and availability of protected information. Specifically, an integer overflow in the
rsCStrExtendBuf function in the imfile module can cause a denial of service (daemon hang) via a large file, triggering a heap-based buffer overflow.Recommendations
For versions prior to 8.4.2, update to version 8.4.2 or later.
For versions 4.x prior to 4.6.6, update to version 4.6.6 or later.
For versions 5.x prior to 5.7.4, update to version 5.7.4 or later.
For versions 6.x prior to 6.1.4, update to version 6.1.4 or later.
As a temporary workaround, consider restricting access to large files that could trigger the heap-based buffer overflow in the imfile module.
Correção
DoS
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Centos
Red Hat
Rsyslog