CVE-2011-1951: Medium severity syslog-ng vulnerability
A denial of service flaw was found in the way syslog-ng processed certain log patterns, when 'global' flag was speficied and PCRE backend was used for matching. A remote attacker could use this flaw to cause excessive memory use by the syslog-ng process via specially-crafted pattern.
References: [1] http://www.securityfocus.com/bid/47800/info [2] https://lists.balabit.hu/pipermail/syslog-ng/2011-May/016576.html
Upstream patch: [3] http://git.balabit.hu/?p=bazsi/syslog-ng-3.2.git;a=commit;h=09710c0b105e579d35c7b5f6c66d1ea5e3a3d3ff
Other sources
lib/logmatcher.c in Balabit syslog-ng before 3.2.4, when the global flag is set and when using PCRE 8.12 and possibly other versions, allows remote attackers to cause a denial of service (memory consumption) via a message that does not match a regular expression.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-1951?
CVE-2011-1951 has been classified as a denial of service vulnerability.
How do I fix CVE-2011-1951?
To fix CVE-2011-1951, upgrade syslog-ng to version 3.2.4 or later.
What can an attacker achieve with CVE-2011-1951?
An attacker can cause excessive memory usage in the syslog-ng process through specially-crafted log patterns.
Which versions of syslog-ng are affected by CVE-2011-1951?
Syslog-ng versions prior to 3.2.4 are affected by CVE-2011-1951.
Does CVE-2011-1951 affect the PCRE version?
CVE-2011-1951 specifically affects syslog-ng when the PCRE backend is used for matching.