oss-security - Re: CVE Request - rsyslog ($allowedSender issue repost + imudp DoS)

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <1229362201.14026.7.camel@dhcp-lab-164.englab.brq.redhat.com>
Date: Mon, 15 Dec 2008 18:30:01 +0100
From: Jan Lieskovsky <jlieskov@...hat.com>
To: oss-security <oss-security@...ts.openwall.com>
Subject: Re: CVE Request - rsyslog ($allowedSender issue
	repost + imudp DoS)

Hello Steve,

  rsyslog upstream has fixed DoS in rsyslog's imudp
plugin -- "imudp emitted a message when a non-permitted sender
tried to send a message to it. This behaviour is operator-configurable."

Changelog: http://www.rsyslog.com/Topic4.phtml
Upstream commit: http://git.adiscon.com/?p=rsyslog.git;a=commit;h=afdccceefa30306cf720a27efd5a29bcc5a916c9
Affected versions: 3.20.2 [v3-stable], 3.21.9 [BETA], 4.1.2 [DEVEL]

On Mon, 2008-12-08 at 15:53 +0100, Jan Lieskovsky wrote:
> Hello Steve,
> 
>   the following vulnerability has been recently reported
> in rsyslog:
> 
> http://www.rsyslog.com/Article322.phtml
> 
> References:
> http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=508027
> http://secunia.com/Advisories/32857/
> 
> Upstream patch:
> http://git.adiscon.com/?p=rsyslog.git;a=commitdiff;h=f0ddbed44c332391ae6d9bbf6b07e2f06c4dd676
> 
> The reporter mentions:
> "The versions affected are rsyslog 3.12.1 to 3.20.0, 4.1.0 and 4.1.1.    
>  The v2-stable branch is not affected."

Could you allocate a new CVE id for these two rsyslog flaws?

Thanks, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Response Team

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.