CVE-2008-5110: Critical severity syslog-ng vulnerability
Published Nov 17, 2008
·Updated
syslog-ng does not call chdir when it calls chroot, which might allow attackers to escape the intended jail. NOTE: this is only a vulnerability when a separate vulnerability is present. This flaw affects syslog-ng versions prior to and including 2.0.9.
Affected Software
1 affected component
Oneidentity Syslog-ng<=2.0.9
Event History
Nov 17, 2008
CVE Published
via MITRE·10:00 PM
Data Sourced
via MITRE·10:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2008-5110?
CVE-2008-5110 is considered a moderate severity vulnerability that allows potential jail escape for attackers.
2
How do I fix CVE-2008-5110?
To fix CVE-2008-5110, upgrade syslog-ng to a version later than 2.0.9.
3
Which versions of syslog-ng are affected by CVE-2008-5110?
CVE-2008-5110 affects syslog-ng versions up to and including 2.0.9.
4
Is CVE-2008-5110 exploitable on its own?
CVE-2008-5110 requires the presence of another vulnerability to be exploitable.
5
How does CVE-2008-5110 pose a risk in a chroot environment?
CVE-2008-5110 allows attackers to escape the chroot jail due to the absence of chdir in the chroot call.