CVE Request (syslog-ng)

[Josh Bressers <bressers () redhat com>]

Hi Steve,

I'm pretty sure this one deserves a CVE id.

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=505791

syslog-ng doesn't call chdir() before calling chroot().  The chroot(2) man page is
quite clear that if you don't call chdir() first, the process will inherit a '.'
that is outside of the chroot.

By itself this isn't really a flaw (you'll need some other exploit to even attempt to break out of the chroot), and 
chroot can be broken out of various other ways.
Typically chroot() should not be considered secure, but I suspect this should
probably get an ID if for no other reason than avoiding future confusion.

Thanks.

-- 
    JB