Bug 381637 – <app-admin/rsyslog-5.8.5 Malformed TAG DoS (CVE-2011-3200)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Agostino Sarubbo 2011-09-03 00:44:37 UTC]

From secunia security advisor at $URL:

Description:
The vulnerability is caused due to an off-by-two error within the "parseLegacySyslogMsg()" function (tools/syslogd.c) and can be exploited to cause a limited stack-based buffer overflow by sending an overly long TAG within a legacy syslog message.

Solution:
Update to versions 5.8.5.

(Not mentioned version 4 because there is in main tree)

[Comment 1 Agostino Sarubbo 2011-09-03 00:50:03 UTC]

5.8.5 is available, please bump =)

[Comment 2 Alex Legler (RETIRED) 2011-09-03 10:27:46 UTC]

http://www.rsyslog.com/potential-dos-with-malformed-tag/ states the impact is DoS. Code execution is not possible.

[Comment 3 Ultrabug 2011-09-05 09:27:41 UTC]

Thank you Agostino, I have bumped rsyslog to latest version and removed the useless 5.8.1 vulnerable version.

+*rsyslog-5.8.5 (05 Sep 2011)
+
+  05 Sep 2011; Ultrabug <[e-mail]> files/5-stable/rsyslog.initd,
+  -rsyslog-5.8.1.ebuild, +rsyslog-5.8.5.ebuild, metadata.xml:
+  Init script handles baselayout 1 & 2, fix #373913 thanks to Martin Dummer for
+  reporting. Version bump wrt #381637 and drop old vulnerable version. Add
+  optional zeromq support to rsyslog.
+

Next steps proposed :

- ask for 5.8.3 stabilization so we can remove 5.6.5
- wait one month and stabilize 5.8.5

Are you okay with this ?

[Comment 4 Agostino Sarubbo 2011-09-05 09:37:59 UTC]

Thanks Alexys,

(In reply to comment #3)
> Next steps proposed :
> 
> - ask for 5.8.3 stabilization so we can remove 5.6.5
> - wait one month and stabilize 5.8.5
> 
> Are you okay with this ?

No, we stabilize now the version not affected to CVE (as usual).


Arches, please test and mark stable:

=app-admin/rsyslog-5.8.5
target KEYWORDS : "amd64 hppa x86"

[Comment 5 Agostino Sarubbo 2011-09-05 10:45:17 UTC]

@maintainer
the ebuild seems have differents problems, so not all are a blockers.
Please check:
bug 381901 
bug 381903 
bug 381905 
bug 381907 
bug 381909 
bug 381911

[Comment 6 Ultrabug 2011-09-05 12:24:10 UTC]

All fixed, thanks again Ago.

[Comment 7 Agostino Sarubbo 2011-09-05 13:59:50 UTC]

(In reply to comment #6)
> All fixed, thanks again Ago.

Thanks. amd64 perfect now.

[Comment 8 Tony Vroon (RETIRED) 2011-09-05 14:02:10 UTC]

+  05 Sep 2011; Tony Vroon <[e-mail]> rsyslog-5.8.5.ebuild:
+  Marked stable on AMD64 based on arch testing by Agostino "ago" Sarubbo in bug
+  #381637.

[Comment 9 Jeff (JD) Horelick (RETIRED) 2011-09-05 17:18:02 UTC]

Archtested on x86: Everything fine

[Comment 10 Jeroen Roovers (RETIRED) 2011-09-09 14:23:58 UTC]

Stable for HPPA.

[Comment 11 unknown 2011-09-11 01:20:52 UTC]

Cannot emerge 5.8.5 from stage3, pkgconfig dependency is missing:

...
checking for FSSTND support... yes
/var/tmp/portage/app-admin/rsyslog-5.8.5/work/rsyslog-5.8.5/configure: line 16014: syntax error near unexpected token `GNUTLS,'
/var/tmp/portage/app-admin/rsyslog-5.8.5/work/rsyslog-5.8.5/configure: line 16014: ` PKG_CHECK_MODULES(GNUTLS, gnutls >= 1.4.0)'

!!! Please attach the following file when seeking support:
!!! /var/tmp/portage/app-admin/rsyslog-5.8.5/work/rsyslog-5.8.5/config.log
* ERROR: app-admin/rsyslog-5.8.5 failed (configure phase):
* econf failed

[Comment 12 Agostino Sarubbo 2011-09-11 07:46:42 UTC]

PLease open a new bug for this.

[Comment 13 Markus Meier 2011-09-11 09:28:38 UTC]

x86 stable, thanks JD

[Comment 14 Tim Sammut (RETIRED) 2011-09-11 15:07:33 UTC]

Thanks, folks. GLSA Vote: yes.

[Comment 15 Ultrabug 2011-09-13 12:18:24 UTC]

Thanks guys, old vulnerable versions removed fyi.

[Comment 16 GLSAMaker/CVETool Bot 2011-10-07 22:47:52 UTC]

CVE-2011-3200 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3200):
  Stack-based buffer overflow in the parseLegacySyslogMsg function in
  tools/syslogd.c in rsyslogd in rsyslog 4.6.x before 4.6.8 and 5.2.0 through
  5.8.4 might allow remote attackers to cause a denial of service (application
  exit) via a long TAG in a legacy syslog message.

[Comment 17 Stefan Behte (RETIRED) 2011-10-08 21:07:24 UTC]

Vote: NO.

[Comment 18 Tobias Heinlein (RETIRED) 2011-10-08 21:11:28 UTC]

NO too, closing. Thanks everyone.