PT-2019-5762 · Rsyslog+5 · Rsyslog+5
Rgerhards
·
Published
2019-09-30
·
Updated
2022-05-12
·
CVE-2019-17042
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Rsyslog version 8.1908.0
Description
An issue was discovered in the parser for Cisco log messages in the contrib/pmcisconames/pmcisconames.c file. The parser fails to account for strings that do not satisfy the constraint of having a log message delimiter, such as a space or a colon. This can cause the variable
lenMsg to reach zero, skip the sanity check, and consider the message valid. As a result, the parser will attempt to shift left the contents of the message, calling memmove with the right pointers, but the lenMsg will be interpreted as a huge value, causing a heap overflow. This can allow a remote attacker to access confidential data, disrupt its integrity, and cause a denial of service.Recommendations
For Rsyslog version 8.1908.0, consider disabling the
pmcisconames module or restricting its use until a patch is available to prevent exploitation of the heap overflow vulnerability in the parser for Cisco log messages.Fix
RCE
Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Astra Linux
Centos
Red Hat
Rsyslog
Suse
Ubuntu