PT-2014-1869 · Rsyslog+7 · Rsyslog+7
Rainer Gerhards
·
Publicado
2014-10-01
·
Atualizado
2024-06-15
·
CVE-2014-3634
CVSS v2.0
7.5
Alta
| Vetor | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
rsyslog versions prior to 7.6.6
rsyslog 8.x versions prior to 8.4.1
sysklogd version 1.5 and earlier
Description
The issue allows remote attackers to cause a denial of service, possibly execute arbitrary code, or have other unspecified impact via a crafted priority value that triggers an out-of-bounds array access. This can lead to a disruption of confidentiality, integrity, and availability of protected information. The vulnerability can be exploited remotely.
Recommendations
For rsyslog versions prior to 7.6.6, update to version 7.6.6 or later.
For rsyslog 8.x versions prior to 8.4.1, update to version 8.4.1 or later.
For sysklogd version 1.5 and earlier, update to a version later than 1.5.
As a temporary workaround, consider restricting access to the service to minimize the risk of exploitation.
Exploit
Correção
DoS
Buffer Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Alt Linux
Centos
Ibm Aix
Red Hat
Suse
Ubuntu
Rsyslog
Sysklogd