oss-sec mailing list archives
sysklogd vulnerability (CVE-2014-3634)
From: mancha <mancha1 () zoho com>
Date: Fri, 3 Oct 2014 09:12:28 +0000
Vendors et al. Many thanks to Rainer Gerhards, rsyslog project lead, for identifying a problem with how rsyslog's rsyslogd and sysklogd's syslogd check for invalid priority values (CVE-2014-3634). For details please refer to Rainer's well-written issue description. [1] In sysklogd's syslogd, invalid priority values between 192 and 1023 (directly or arrived at via overflow wraparound) can propagate through code causing out-of-bounds access to the f_pmask array within the 'filed' structure by up to 104 bytes past its end. Though most likely insufficient to reach unallocated memory because there are around 544 bytes past f_pmask in 'filed' (mod packing and other differences), incorrect access of fields at higher positions of the 'filed' structure definition can cause unexpected behavior including message mis-classification, forwarding issues, message loss, or other. I've been unable to contact sysklogd's maintainer (the project is no longer active) but, given some vendors ship sysklogd as their system logging daemon, it was important to share a fix. Fix for sysklogd 1.5 is available at: http://sf.net/projects/mancha/files/sec/sysklogd-1.5_CVE-2014-3634.diff Note: publication of this patch was intentionally delayed to afford the rsyslog project time to correct their initial fix set which was vulnerable to integer overflows (CVE-2014-3683). [2] --mancha === [1] http://www.rsyslog.com/remote-syslog-pri-vulnerability/ [2] http://www.rsyslog.com/remote-syslog-pri-vulnerability-cve-2014-3683/
Attachment:
_bin
Description:
Current thread:
- sysklogd vulnerability (CVE-2014-3634) mancha (Oct 03)
- Re: sysklogd vulnerability (CVE-2014-3634) mancha (Oct 03)
- Re: sysklogd vulnerability (CVE-2014-3634) Solar Designer (Oct 03)
- Re: sysklogd vulnerability (CVE-2014-3634) Rainer Gerhards (Oct 03)
- Re: sysklogd vulnerability (CVE-2014-3634) mancha (Oct 03)
- Re: sysklogd vulnerability (CVE-2014-3634) Rainer Gerhards (Oct 03)
- Re: sysklogd vulnerability (CVE-2014-3634) mancha (Oct 03)
- Re: sysklogd vulnerability (CVE-2014-3634) Rainer Gerhards (Oct 05)
- Re: sysklogd vulnerability (CVE-2014-3634) mancha (Oct 06)
- Re: sysklogd vulnerability (CVE-2014-3634) Solar Designer (Oct 03)
- Re: sysklogd vulnerability (CVE-2014-3634) mancha (Oct 03)
- Re: sysklogd vulnerability (CVE-2014-3634) mancha (Oct 03)