Amazon Linux AMI update for rsyslog



Published: 2024-08-06
Risk High
Patch available YES
Number of vulnerabilities 2
CVE-ID CVE-2014-3634
CVE-2022-24903
CWE-ID CWE-119
CWE-122
Exploitation vector Network
Public exploit N/A
Vulnerable software
Subscribe 		Amazon Linux AMI
Operating systems & Components / Operating system

Vendor Amazon Web Services

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Buffer overflow

EUVDB-ID: #VU32475

Risk: Medium

CVSSv3.1: 6.4 [CVSS:3.1/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2014-3634

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

rsyslog before 7.6.6 and 8.x before 8.4.1 and sysklogd 1.5 and earlier allows remote attackers to cause a denial of service (crash), possibly execute arbitrary code, or have other unspecified impact via a crafted priority (PRI) value that triggers an out-of-bounds array access.

Mitigation

Update the affected packages:

aarch64:
    rsyslog-mmnormalize-debuginfo-8.2204.0-3.amzn2023.0.2.aarch64
    rsyslog-crypto-debuginfo-8.2204.0-3.amzn2023.0.2.aarch64
    rsyslog-crypto-8.2204.0-3.amzn2023.0.2.aarch64
    rsyslog-logrotate-8.2204.0-3.amzn2023.0.2.aarch64
    rsyslog-mmaudit-8.2204.0-3.amzn2023.0.2.aarch64
    rsyslog-mmjsonparse-8.2204.0-3.amzn2023.0.2.aarch64
    rsyslog-openssl-debuginfo-8.2204.0-3.amzn2023.0.2.aarch64
    rsyslog-debugsource-8.2204.0-3.amzn2023.0.2.aarch64
    rsyslog-8.2204.0-3.amzn2023.0.2.aarch64
    rsyslog-elasticsearch-debuginfo-8.2204.0-3.amzn2023.0.2.aarch64
    rsyslog-mmfields-debuginfo-8.2204.0-3.amzn2023.0.2.aarch64
    rsyslog-elasticsearch-8.2204.0-3.amzn2023.0.2.aarch64
    rsyslog-mmkubernetes-debuginfo-8.2204.0-3.amzn2023.0.2.aarch64
    rsyslog-openssl-8.2204.0-3.amzn2023.0.2.aarch64
    rsyslog-mmjsonparse-debuginfo-8.2204.0-3.amzn2023.0.2.aarch64
    rsyslog-mmnormalize-8.2204.0-3.amzn2023.0.2.aarch64
    rsyslog-mmaudit-debuginfo-8.2204.0-3.amzn2023.0.2.aarch64
    rsyslog-mmkubernetes-8.2204.0-3.amzn2023.0.2.aarch64
    rsyslog-mmfields-8.2204.0-3.amzn2023.0.2.aarch64
    rsyslog-debuginfo-8.2204.0-3.amzn2023.0.2.aarch64

noarch:
    rsyslog-doc-8.2204.0-3.amzn2023.0.2.noarch

src:
    rsyslog-8.2204.0-3.amzn2023.0.2.src

x86_64:
    rsyslog-mmfields-debuginfo-8.2204.0-3.amzn2023.0.2.x86_64
    rsyslog-mmaudit-debuginfo-8.2204.0-3.amzn2023.0.2.x86_64
    rsyslog-debugsource-8.2204.0-3.amzn2023.0.2.x86_64
    rsyslog-mmnormalize-debuginfo-8.2204.0-3.amzn2023.0.2.x86_64
    rsyslog-mmaudit-8.2204.0-3.amzn2023.0.2.x86_64
    rsyslog-openssl-debuginfo-8.2204.0-3.amzn2023.0.2.x86_64
    rsyslog-mmjsonparse-8.2204.0-3.amzn2023.0.2.x86_64
    rsyslog-mmjsonparse-debuginfo-8.2204.0-3.amzn2023.0.2.x86_64
    rsyslog-elasticsearch-8.2204.0-3.amzn2023.0.2.x86_64
    rsyslog-debuginfo-8.2204.0-3.amzn2023.0.2.x86_64
    rsyslog-mmkubernetes-debuginfo-8.2204.0-3.amzn2023.0.2.x86_64
    rsyslog-logrotate-8.2204.0-3.amzn2023.0.2.x86_64
    rsyslog-crypto-8.2204.0-3.amzn2023.0.2.x86_64
    rsyslog-elasticsearch-debuginfo-8.2204.0-3.amzn2023.0.2.x86_64
    rsyslog-openssl-8.2204.0-3.amzn2023.0.2.x86_64
    rsyslog-mmfields-8.2204.0-3.amzn2023.0.2.x86_64
    rsyslog-crypto-debuginfo-8.2204.0-3.amzn2023.0.2.x86_64
    rsyslog-8.2204.0-3.amzn2023.0.2.x86_64
    rsyslog-mmkubernetes-8.2204.0-3.amzn2023.0.2.x86_64
    rsyslog-mmnormalize-8.2204.0-3.amzn2023.0.2.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3 External links

http://alas.aws.amazon.com/AL2023/ALAS-2023-001.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Heap-based buffer overflow

EUVDB-ID: #VU62830

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-24903

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service or potentially execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when parsing data in imtcp, imptcp, imgssapi, and imhttp modules used for TCP syslog reception. A remote attacker can pass specially crafted data to the application, trigger heap-based buffer overflow and cause a denial of service or potentially execute arbitrary code on the target system.

Successful exploitation of this vulnerability is possible if the attacker is able to directly send specially crafted messages to the rsyslog daemon or by injecting specially crafted data into log files. Vulnerability exploitation in the second scenario requires that the rsyslog client supports octet-counted framing, which is not a default configuration.

Mitigation

Update the affected packages:

aarch64:
    rsyslog-mmnormalize-debuginfo-8.2204.0-3.amzn2023.0.2.aarch64
    rsyslog-crypto-debuginfo-8.2204.0-3.amzn2023.0.2.aarch64
    rsyslog-crypto-8.2204.0-3.amzn2023.0.2.aarch64
    rsyslog-logrotate-8.2204.0-3.amzn2023.0.2.aarch64
    rsyslog-mmaudit-8.2204.0-3.amzn2023.0.2.aarch64
    rsyslog-mmjsonparse-8.2204.0-3.amzn2023.0.2.aarch64
    rsyslog-openssl-debuginfo-8.2204.0-3.amzn2023.0.2.aarch64
    rsyslog-debugsource-8.2204.0-3.amzn2023.0.2.aarch64
    rsyslog-8.2204.0-3.amzn2023.0.2.aarch64
    rsyslog-elasticsearch-debuginfo-8.2204.0-3.amzn2023.0.2.aarch64
    rsyslog-mmfields-debuginfo-8.2204.0-3.amzn2023.0.2.aarch64
    rsyslog-elasticsearch-8.2204.0-3.amzn2023.0.2.aarch64
    rsyslog-mmkubernetes-debuginfo-8.2204.0-3.amzn2023.0.2.aarch64
    rsyslog-openssl-8.2204.0-3.amzn2023.0.2.aarch64
    rsyslog-mmjsonparse-debuginfo-8.2204.0-3.amzn2023.0.2.aarch64
    rsyslog-mmnormalize-8.2204.0-3.amzn2023.0.2.aarch64
    rsyslog-mmaudit-debuginfo-8.2204.0-3.amzn2023.0.2.aarch64
    rsyslog-mmkubernetes-8.2204.0-3.amzn2023.0.2.aarch64
    rsyslog-mmfields-8.2204.0-3.amzn2023.0.2.aarch64
    rsyslog-debuginfo-8.2204.0-3.amzn2023.0.2.aarch64

noarch:
    rsyslog-doc-8.2204.0-3.amzn2023.0.2.noarch

src:
    rsyslog-8.2204.0-3.amzn2023.0.2.src

x86_64:
    rsyslog-mmfields-debuginfo-8.2204.0-3.amzn2023.0.2.x86_64
    rsyslog-mmaudit-debuginfo-8.2204.0-3.amzn2023.0.2.x86_64
    rsyslog-debugsource-8.2204.0-3.amzn2023.0.2.x86_64
    rsyslog-mmnormalize-debuginfo-8.2204.0-3.amzn2023.0.2.x86_64
    rsyslog-mmaudit-8.2204.0-3.amzn2023.0.2.x86_64
    rsyslog-openssl-debuginfo-8.2204.0-3.amzn2023.0.2.x86_64
    rsyslog-mmjsonparse-8.2204.0-3.amzn2023.0.2.x86_64
    rsyslog-mmjsonparse-debuginfo-8.2204.0-3.amzn2023.0.2.x86_64
    rsyslog-elasticsearch-8.2204.0-3.amzn2023.0.2.x86_64
    rsyslog-debuginfo-8.2204.0-3.amzn2023.0.2.x86_64
    rsyslog-mmkubernetes-debuginfo-8.2204.0-3.amzn2023.0.2.x86_64
    rsyslog-logrotate-8.2204.0-3.amzn2023.0.2.x86_64
    rsyslog-crypto-8.2204.0-3.amzn2023.0.2.x86_64
    rsyslog-elasticsearch-debuginfo-8.2204.0-3.amzn2023.0.2.x86_64
    rsyslog-openssl-8.2204.0-3.amzn2023.0.2.x86_64
    rsyslog-mmfields-8.2204.0-3.amzn2023.0.2.x86_64
    rsyslog-crypto-debuginfo-8.2204.0-3.amzn2023.0.2.x86_64
    rsyslog-8.2204.0-3.amzn2023.0.2.x86_64
    rsyslog-mmkubernetes-8.2204.0-3.amzn2023.0.2.x86_64
    rsyslog-mmnormalize-8.2204.0-3.amzn2023.0.2.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3 External links

http://alas.aws.amazon.com/AL2023/ALAS-2023-001.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###