PT-2011-2282 · Balabit · Syslog-Ng

Steven Chamberlain · Published 2011-01-28 · Updated 2020-05-19 · CVE-2011-0343

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Medium

Base vector

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Balabit syslog-ng versions 2.0, 3.0, 3.1, 3.2 OSE and PE

Description The issue is related to improper cast operations when running on certain operating systems, resulting in the creation of log files with insecure permissions. This allows local users to read and write to these log files.

Recommendations For Balabit syslog-ng versions 2.0, 3.0, 3.1, 3.2 OSE and PE, consider changing the default permissions to a more secure setting to prevent unauthorized access to log files.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2011-0343

OPENSUSE-SU-2024:10493-1

Affected Products

Syslog-Ng

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2011-0343 · Security Note
• https://lists.balabit.com/pipermail/syslog-ng-announce/2011-January/000101.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2011-0343 · Vendor Advisory
• https://lists.balabit.com/pipermail/syslog-ng-announce/2011-January/000102.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-0343 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2011-0343 · Vendor Advisory
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=608491 · Patch
• http://securityfocus.com/archive/1/515955/100/0/threaded · Note
• http://securityfocus.com/bid/45988 · Note