PT-2008-6672 · Rsyslog · Rsyslog

Published 2008-12-17 · Updated 2017-08-08 · CVE-2008-5617

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:C

Name of the Vulnerable Software and Affected Versions rsyslog versions 3.12.1 through 3.20.0 rsyslog version 4.1.0 rsyslog version 4.1.1

Description The issue concerns the ACL handling in rsyslog, where it fails to follow the $AllowedSender directive. This allows remote attackers to bypass intended access restrictions. As a result, attackers can spoof log messages or create a large number of spurious messages.

Recommendations For rsyslog versions 3.12.1 through 3.20.0, consider restricting access to the logging mechanism to minimize the risk of exploitation. For rsyslog version 4.1.0, restrict access to the logging mechanism to minimize the risk of exploitation. For rsyslog version 4.1.1, restrict access to the logging mechanism to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2008-5617

Affected Products

Rsyslog

References · 10

• http://secunia.com/advisories/32857 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2008-5617 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-5617 · Security Note
• http://rsyslog.com/Article322.phtml · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2008-5617 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2008-5617 · Vendor Advisory
• http://securityfocus.com/bid/32630 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/47080 · Note
• http://rsyslog.com/Topic4.phtml · Note
• http://rsyslog.com/Article327.phtml · Note