Integer overflow in rsyslog before 7.6.7 and 8.x before 8.4.2 and sysklogd 1.5 and earlier allows remote attackers to cause a denial of service (crash) via a large priority (PRI) value. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-3634.

This update for rsyslog provides the following fixes :

  - Fixed remote PRI DoS vulnerability patch (CVE-2014-3683,     bnc#899756)

  - Removed broken, unsupported and dropped by upstream     zpipe utility from rsyslog-diag-tools package     (bnc#890228)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201412-35 (RSYSLOG: Denial of Service)

    Multiple vulnerabilities have been discovered in RSYSLOG. Please review       the CVE identifiers referenced below for details.
  Impact :

    A context-dependent attacker may be able to create a Denial of Service       condition.
  Workaround :

    There is no known workaround at this time.

The version of rsyslog installed on the remote AIX host is affected by a remote code execution or denial of service vulnerability :

  - The installed rsyslog allows remote attackers to cause a     denial of service (crash), possibly execute arbitrary     code, or have other unspecified impacts by crafting a     priority (PRI) value that triggers an out-of-bounds     array access. (CVE-2014-3634)

  - The original fix for the above issue still retained a     denial of service vulnerability when large PRI values     were encountered. (CVE-2014-3683)

Updated rsyslog packages fix security vulnerability :

Rainer Gerhards, the rsyslog project leader, reported a vulnerability in Rsyslog. As a consequence of this vulnerability an attacker can send malformed messages to a server, if this one accepts data from untrusted sources, and trigger a denial of service attack (CVE-2014-3634).

- Fixed PRI DoS vulnerability patch     (CVE-2014-3683,bnc#899756) [*     rsyslog-7.4.7-remote-PRI-DoS-fix-backport_CVE-2014-3634.
    patch]

  - Removed broken, unsupported and dropped by upstream     zpipe utility from rsyslog-diag-tools package     (bnc#890228)

  - Remote syslog PRI DoS vulnerability fix     (CVE-2014-3634,bnc#897262) [+     rsyslog-7.4.7-remote-PRI-DoS-fix-backport_CVE-2014-3634.
    patch]

- Fixed remote PRI DoS vulnerability patch     (CVE-2014-3683,bnc#899756) [*     rsyslog-7.2.7-remote-PRI-DoS-fix-backport_CVE-2014-3634.
    patch]

  - Removed broken, unsupported and dropped by upstream     zpipe utility from rsyslog-diag-tools package     (bnc#890228)

  - Remote syslog PRI DoS vulnerability fix     (CVE-2014-3634,bnc#897262) [+     rsyslog-7.2.7-remote-PRI-DoS-fix-backport_CVE-2014-3634.
    patch]

rsyslog has been updated to fix a remote denial of service issue :

  - Under certain configurations, a local or remote attacker     able to send syslog messages to the server could have     crashed the log server due to an array overread.
    (CVE-2014-3634 / CVE-2014-3683)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2381-1 advisory.

    It was discovered that Rsyslog incorrectly handled invalid PRI values. An attacker could use this issue to     send malformed messages to the Rsyslog server and cause it to stop responding, resulting in a denial of     service and possibly message loss. (CVE-2014-3634, CVE-2014-3683)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Mancha discovered a vulnerability in rsyslog, a system for log processing. This vulnerability is an integer overflow that can be triggered by malformed messages to a server, if this one accepts data from untrusted sources, provoking message loss, denial of service and, potentially, remote code execution.

This vulnerability can be seen as an incomplete fix of CVE-2014-3634 (DSA 3040-1).

For more information:
http://www.rsyslog.com/remote-syslog-pri-vulnerability-cve-2014-3683/

ID	Name	Product	Family	Severity
83644	SUSE SLED12 / SLES12 Security Update : update for rsyslog (SUSE-SU-2014:1438-1)	Nessus	SuSE Local Security Checks	high
80240	GLSA-201412-35 : RSYSLOG: Denial of Service	Nessus	Gentoo Local Security Checks	high
79660	AIX rsyslog Advisory : rsyslog_advisory.asc	Nessus	AIX Local Security Checks	high
78612	Mandriva Linux Security Advisory : rsyslog (MDVSA-2014:196)	Nessus	Mandriva Local Security Checks	high
78498	openSUSE Security Update : rsyslog (openSUSE-SU-2014:1297-1)	Nessus	SuSE Local Security Checks	high
78497	openSUSE Security Update : rsyslog (openSUSE-SU-2014:1298-1)	Nessus	SuSE Local Security Checks	high
78464	SuSE 11.3 Security Update : rsyslog (SAT Patch Number 9840)	Nessus	SuSE Local Security Checks	high
78261	Ubuntu 14.04 LTS : Rsyslog vulnerabilities (USN-2381-1)	Nessus	Ubuntu Local Security Checks	critical
78091	Debian DSA-3047-1 : rsyslog - security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2014-3683

critical

Tenable Plugins

high

high

high

high

high

high

high

critical

medium