Buffer overflow in rsyslog - CVE-2019-17041

Vulnerability identifier: #VU22770

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-17041

CWE-ID: CWE-119

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists in "contrib/pmaixforwardedfrom/pmaixforwardedfrom.c" due to a boundary error in the parser for AIX log messages. A remote attacker can trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

rsyslog
Isolation Segment
VMware Tanzu Application Service for VMs
Juniper Cloud Native Router
Red Hat Virtualization
Red Hat Virtualization for IBM Power LE
Red Hat Virtualization Manager
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for x86_64
Opensuse
Ubuntu
Fedora
rsyslog (Red Hat package)
rsyslog (Alpine package)
rsyslog (Ubuntu package)
rsyslog
Junos cRPD

Install updates from vendor's website.

rsyslog - update to 8.1910.0
rsyslog (Red Hat package) - addressed in versions 8.24.0-52.el7, 8.1911.0-3.el8
rsyslog (Alpine package) - update to 8.31.0-r1
rsyslog (Ubuntu package) - update to 8.16.01ubuntu3.1+esm1
rsyslog - addressed in versions 8.1911.0-1.fc30, 8.1911.0-1.fc31
Juniper Cloud Native Router - update to 23.4R1
Junos cRPD - update to 23.4R1

• http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00031.html
• https://github.com/rsyslog/rsyslog/blob/v8-stable/ChangeLog
• https://github.com/rsyslog/rsyslog/pull/3884

• OpenSUSE Linux update for rsyslog
• OpenSUSE Linux update for rsyslog
• Multiple vulnerabilities in Rsyslog
• Red Hat Enterprise Linux 7 update for rsyslog
• Red Hat Enterprise Linux 8 update for rsyslog
• Buffer overflow in rsyslog (Alpine package)
• Ubuntu update for rsyslog
• VMware Tanzu products update for Rsyslog
• Multiple vulnerabilities in Juniper Cloud Native Router
• Multiple vulnerabilities in Juniper Networks Junos cRPD
• Fedora 31 update for rsyslog
• Fedora 30 update for rsyslog