CVE-2011-0343: Medium severity syslog-ng vulnerability
Balabit syslog-ng 2.0, 3.0, 3.1, 3.2 OSE and PE, when running on FreeBSD or HP-UX, does not properly perform cast operations, which causes syslog-ng to use a default value of -1 to create log files with insecure permissions (07777), which allows local users to read and write to these log files.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-0343?
CVE-2011-0343 is considered to be of medium severity due to its potential for local user exploitation.
How do I fix CVE-2011-0343?
To fix CVE-2011-0343, users should upgrade to the latest version of syslog-ng that is not affected by this vulnerability.
What versions of syslog-ng are affected by CVE-2011-0343?
CVE-2011-0343 affects syslog-ng versions 2.0, 3.0, 3.1, and 3.2 OSE and PE running on FreeBSD or HP-UX.
What type of permissions issue does CVE-2011-0343 cause?
CVE-2011-0343 causes syslog-ng to create log files with insecure permissions of 07777.
Who can exploit CVE-2011-0343 once it is present?
CVE-2011-0343 can be exploited by local users to read and write to the insecure log files.