rsyslog up to 5.7.5 Daemon Log Message release of resource

Summaryinfo

A vulnerability, which was classified as problematic, has been found in rsyslog up to 5.7.5. The impacted element is an unknown function of the component Daemon. The manipulation as part of Log Message leads to release of resource. This vulnerability is traded as CVE-2011-1488. An attack has to be approached locally. There is no exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in rsyslog up to 5.7.5. This issue affects an unknown functionality of the component Daemon. The manipulation as part of a Log Message leads to a release of resource vulnerability. Using CWE to declare the problem leads to CWE-772. The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed. Impacted is availability. The summary by CVE is:

A memory leak in rsyslog before 5.7.6 was found in the way deamon processed log messages are logged when $RepeatedMsgReduction was enabled. A local attacker could use this flaw to cause a denial of the rsyslogd daemon service by crashing the service via a sequence of repeated log messages sent within short periods of time.

The bug was discovered 03/03/2011. The weakness was shared 11/14/2019. The identification of this vulnerability is CVE-2011-1488 since 03/21/2011. Attacking locally is a requirement. The successful exploitation needs a simple authentication. The technical details are unknown and an exploit is not publicly available.

The vulnerability was handled as a non-public zero-day exploit for at least 22 days. During that time the estimated underground price was around $0-$5k. The vulnerability scanner Nessus provides a plugin with the ID 76012 (openSUSE Security Update : rsyslog (openSUSE-SU-2011:0326-1)), which helps to determine the existence of the flaw in a target environment. It is assigned to the family SuSE Local Security Checks and running in the context l. The commercial vulnerability scanner Qualys is able to test this issue with plugin 165189 (SUSE Security Update for Multiple Packages (SUSE-SR:2011:007)).

Upgrading to version 5.7.6 eliminates this vulnerability. A possible mitigation has been published before and not just after the disclosure of the vulnerability.

The vulnerability is also documented in the databases at Tenable (76012) and OSVDB (75190†). The entries VDB-145560 and VDB-145561 are related to this item. Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Name

• rsyslog

Version

• 5.7.0
• 5.7.1
• 5.7.2
• 5.7.3
• 5.7.4
• 5.7.5

License

• open-source

Website

• Product: https://github.com/rsyslog/rsyslog/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion