Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 524508 - app-admin/sysklogd: remote pri vulnerability
Summary: app-admin/sysklogd: remote pri vulnerability
Status: RESOLVED DUPLICATE of bug 524058
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
URL: http://www.openwall.com/lists/oss-sec...
Whiteboard: B3 [upstream/ebuild]
Keywords:
Depends on:
Blocks:
 
Reported: 2014-10-05 10:24 UTC by Agostino Sarubbo
Modified: 2014-10-05 19:44 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Agostino Sarubbo gentoo-dev 2014-10-05 10:24:49 UTC
From ${URL} :

Many thanks to Rainer Gerhards, rsyslog project lead, for identifying a
problem with how rsyslog's rsyslogd and sysklogd's syslogd check for
invalid priority values (CVE-2014-3634). For details please refer to
Rainer's well-written issue description. [1]

In sysklogd's syslogd, invalid priority values between 192 and 1023
(directly or arrived at via overflow wraparound) can propagate through
code causing out-of-bounds access to the f_pmask array within the
'filed' structure by up to 104 bytes past its end. Though most likely
insufficient to reach unallocated memory because there are around 544
bytes past f_pmask in 'filed' (mod packing and other differences),
incorrect access of fields at higher positions of the 'filed' structure
definition can cause unexpected behavior including message
mis-classification, forwarding issues, message loss, or other.

I've been unable to contact sysklogd's maintainer (the project is no
longer active) but, given some vendors ship sysklogd as their system
logging daemon, it was important to share a fix.

Fix for sysklogd 1.5 is available at:
http://sf.net/projects/mancha/files/sec/sysklogd-1.5_CVE-2014-3634.diff

Note: publication of this patch was intentionally delayed to afford the
rsyslog project time to correct their initial fix set which was
vulnerable to integer overflows (CVE-2014-3683). [2]

--mancha

===
[1] http://www.rsyslog.com/remote-syslog-pri-vulnerability/
[2] http://www.rsyslog.com/remote-syslog-pri-vulnerability-cve-2014-3683/



@maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.
Comment 1 Lars Wendler (Polynomial-C) gentoo-dev 2014-10-05 18:07:06 UTC

*** This bug has been marked as a duplicate of bug 524058 ***
Comment 2 Agostino Sarubbo gentoo-dev 2014-10-05 19:44:05 UTC
I filed another bug to track separately.