rsyslog 8.1908.0 Cisco Log Message pmcisconames.c lenMsg buffer overflow

Summaryinfo

A vulnerability was found in rsyslog 8.1908.0. It has been rated as critical. The affected element is an unknown function of the file contrib/pmcisconames/pmcisconames.c of the component Cisco Log Message Handler. This manipulation of the argument lenMsg as part of Variable causes buffer overflow. This vulnerability is tracked as CVE-2019-17042. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability was found in rsyslog 8.1908.0. It has been declared as critical. Affected by this vulnerability is an unknown function of the file contrib/pmcisconames/pmcisconames.c of the component Cisco Log Message Handler. The manipulation of the argument lenMsg as part of a Variable leads to a buffer overflow vulnerability. The CWE definition for the vulnerability is CWE-120. The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

An issue was discovered in Rsyslog v8.1908.0. contrib/pmcisconames/pmcisconames.c has a heap overflow in the parser for Cisco log messages. The parser tries to locate a log message delimiter (in this case, a space or a colon), but fails to account for strings that do not satisfy this constraint. If the string does not match, then the variable lenMsg will reach the value zero and will skip the sanity check that detects invalid log messages. The message will then be considered valid, and the parser will eat up the nonexistent colon delimiter. In doing so, it will decrement lenMsg, a signed integer, whose value was zero and now becomes minus one. The following step in the parser is to shift left the contents of the message. To do this, it will call memmove with the right pointers to the target and destination strings, but the lenMsg will now be interpreted as a huge value, causing a heap overflow.

The weakness was disclosed 10/07/2019 (GitHub Repository). The advisory is shared at github.com. This vulnerability is known as CVE-2019-17042 since 09/30/2019. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details are known, but no exploit is available.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The entries VDB-142717 and VDB-143016 are pretty similar. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Name

• rsyslog

Version

• 8.1908.0

Website

• Product: https://github.com/rsyslog/rsyslog/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion