Multiple vulnerabilities in rsyslog.com rsyslog

1) Memory leak

EUVDB-ID: #VU30619

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2011-1488

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within rsyslog before 5.7.6 was found in the way deamon processed log messages are logged when $RepeatedMsgReduction was enabled. A local attacker could use this flaw to cause a denial of the rsyslogd daemon service by crashing the service via a sequence of repeated log messages sent within short periods of time. A remote attacker can perform a denial of service attack.

Mitigation

Update to version 5.7.6.

Vulnerable software versions

rsyslog: 5.7.0 - 5.7.5

External links

http://lists.opensuse.org/opensuse-security-announce/2011-04/msg00005.html
http://access.redhat.com/security/cve/cve-2011-1488
http://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-1488
http://github.com/rsyslog/rsyslog/commit/1ef709cc97d54f74d3fdeb83788cc4b01f4c6a2a
http://security-tracker.debian.org/tracker/CVE-2011-1488

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Memory leak

EUVDB-ID: #VU30620

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2011-1489

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within rsyslog before 5.7.6 was found in the way deamon processed log messages were logged when multiple rulesets were used and some output batches contained messages belonging to more than one ruleset. A local attacker could cause denial of the rsyslogd daemon service via a log message belonging to more than one ruleset. A remote attacker can perform a denial of service attack.

Mitigation

Update to version 5.7.6.

Vulnerable software versions

rsyslog: 5.7.0 - 5.7.5

External links

http://lists.opensuse.org/opensuse-security-announce/2011-04/msg00005.html
http://access.redhat.com/security/cve/cve-2011-1489
http://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-1489
http://github.com/rsyslog/rsyslog/commit/1ef709cc97d54f74d3fdeb83788cc4b01f4c6a2a
http://security-tracker.debian.org/tracker/CVE-2011-1489

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Memory leak

EUVDB-ID: #VU30621

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2011-1490

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within rsyslog before 5.7.6 was found in the way deamon processed log messages are logged when multiple rulesets were used and some output batches contained messages belonging to more than one ruleset. A local attacker could cause denial of the rsyslogd daemon service via a log message belonging to more than one ruleset. A remote attacker can perform a denial of service attack.

Mitigation

Update to version 5.7.6.

Vulnerable software versions

rsyslog: 5.7.0 - 5.7.5

External links

http://lists.opensuse.org/opensuse-security-announce/2011-04/msg00005.html
http://access.redhat.com/security/cve/cve-2011-1490
http://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-1490
http://github.com/rsyslog/rsyslog/commit/1ef709cc97d54f74d3fdeb83788cc4b01f4c6a2a
http://security-tracker.debian.org/tracker/CVE-2011-1490

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.