CVE-2008-5617: High severity rsyslog Rsyslog vulnerability
The ACL handling in rsyslog 3.12.1 to 3.20.0, 4.1.0, and 4.1.1 does not follow $AllowedSender directive, which allows remote attackers to bypass intended access restrictions and spoof log messages or create a large number of spurious messages.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Configure the $AllowedSender directive in the rsyslog configuration to explicitly list only trusted sender IP addresses or hostnames so that messages from other senders are rejected. After updating the configuration, reload or restart the rsyslog service to apply the change.
SUSE Rsyslog $AllowedSender = Explicit list of trusted sender IP addresses or hostnames
Event History
Frequently Asked Questions
What is the severity of CVE-2008-5617?
CVE-2008-5617 has a moderate severity rating due to its ability to allow unauthorized log message spoofing.
How do I fix CVE-2008-5617?
To fix CVE-2008-5617, upgrade rsyslog to a version that is not affected, such as 4.2.0 or later.
What systems are affected by CVE-2008-5617?
CVE-2008-5617 affects rsyslog versions from 3.12.1 to 3.20.0, including versions 4.1.0 and 4.1.1.
What are the consequences of exploiting CVE-2008-5617?
Exploiting CVE-2008-5617 can lead to unauthorized log manipulations and flooding the log system with fake messages.
How can I determine if my rsyslog is vulnerable to CVE-2008-5617?
To determine if your rsyslog is vulnerable to CVE-2008-5617, check the version number against the affected versions listed in the CVE description.