CVE-2011-3200: Buffer Overflow
Description of problem:
If we send to syslog a specially crafted log message, stack guard variable protecting bufParseTAG array in parseLegacySyslogMsg() gets rewritten and rsyslog gets terminated.
Version-Release number of selected component (if applicable):
rsyslog-4.6.2-3.el61.1.i686
How reproducible:
everytime on ia-32 on x86-64 stack guard variable won't get rewritten as it is located 8 bytes above bufParseTAG array
Actual results:
glibc prints the following message and rsyslog gets terminated:
stack smashing detected : rsyslogd terminated
Expected results:
No abortion.
Additional info:
For more info, please, see the following private comment.
Other sources
Stack-based buffer overflow in the parseLegacySyslogMsg function in tools/syslogd.c in rsyslogd in rsyslog 4.6.x before 4.6.8 and 5.2.0 through 5.8.4 might allow remote attackers to cause a denial of service (application exit) via a long TAG in a legacy syslog message.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-3200?
CVE-2011-3200 is considered a high severity vulnerability that can lead to denial of service.
How do I fix CVE-2011-3200?
To fix CVE-2011-3200, upgrade to rsyslog version 4.6.8 or 5.8.5 or later.
What systems are affected by CVE-2011-3200?
CVE-2011-3200 affects multiple versions of rsyslog, specifically 4.6.0 to 4.6.7 and 5.4.0 to 5.8.4.
What is the impact of CVE-2011-3200?
The impact of CVE-2011-3200 is that an attacker can terminate the rsyslog service by sending a specially crafted log message.
Can CVE-2011-3200 be exploited remotely?
Yes, CVE-2011-3200 can be exploited remotely if an attacker can send crafted syslog messages to the affected rsyslog service.