PT-2018-1196 · Rsyslog+5 · Librelp+5

Bas Van Schaik + 1 · Published 2018-03-19 · Updated 2023-06-12 · CVE-2018-1000140

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions librelp versions 1.2.14 and earlier

Description The issue is related to a Buffer Overflow vulnerability in the checking of x509 certificates from a peer, which can result in Remote code execution. This can be exploited by a remote attacker that can connect to rsyslog and trigger a stack buffer overflow by sending a specially crafted x509 certificate. The vulnerability is associated with the snprintf() function of the RELP library, which can cause a buffer overflow in memory when processing x509 certificates, allowing a remote attacker to execute arbitrary code.

Recommendations For librelp versions 1.2.14 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Stack Overflow

Buffer Overflow

Memory Corruption

Weakness Enumeration

CWE-121

CWE-119

CWE-787

Related Identifiers

ALT-PU-2018-1561

BDU:2018-00654

CESA-2018_1223

CESA-2018_1225

CVE-2018-1000140

DSA-4151-1

MGASA-2018-0251

OPENSUSE-SU-2018_0829-1

OPENSUSE-SU-2024:10982-1

RHSA-2018:1223

RHSA-2018:1225

RHSA-2018:1701

RHSA-2018:1702

RHSA-2018:1703

RHSA-2018:1704

RHSA-2018:1707

RHSA-2018_1223

RHSA-2018_1225

SUSE-SU-2018:0822-1

SUSE-SU-2018:0828-1

SUSE-SU-2018_0822-1

SUSE-SU-2018_0828-1

SUSE-SU-2022:1891-1

SUSE-SU-2022_1891-1

USN-3612-1

USN-4828-1

Affected Products

Alt Linux

Centos

Red Hat

Suse

Ubuntu

Librelp

References · 70

• 🔥 https://lgtm.com/rules/1505913226124 · Exploit
• https://github.com/rsyslog/librelp/blob/532aa362f0f7a8d037505b0a27a1df452f9bac9e/src/tcp.c#L1205 · Patch
• https://security-tracker.debian.org/tracker/DSA-4151-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3612-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4828-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-1000140 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2018-1561 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:1704 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-1000140 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-1000140 · Security Note
• https://advisories.mageia.org/MGASA-2018-0251.html · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2022:1891-1 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:1223 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:1707 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2018-1223.html · Vendor Advisory