PT-2014-1869 · Rsyslog+7 · Rsyslog+7
Rainer Gerhards
·
Published
2014-10-01
·
Updated
2024-06-15
·
CVE-2014-3634
CVSS v2.0
7.5
High
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
rsyslog versions prior to 7.6.6
rsyslog 8.x versions prior to 8.4.1
sysklogd version 1.5 and earlier
Description
The issue allows remote attackers to cause a denial of service, possibly execute arbitrary code, or have other unspecified impact via a crafted priority value that triggers an out-of-bounds array access. This can lead to a disruption of confidentiality, integrity, and availability of protected information. The vulnerability can be exploited remotely.
Recommendations
For rsyslog versions prior to 7.6.6, update to version 7.6.6 or later.
For rsyslog 8.x versions prior to 8.4.1, update to version 8.4.1 or later.
For sysklogd version 1.5 and earlier, update to a version later than 1.5.
As a temporary workaround, consider restricting access to the service to minimize the risk of exploitation.
Exploit
Fix
DoS
Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Centos
Ibm Aix
Red Hat
Suse
Ubuntu
Rsyslog
Sysklogd