An integer signedness error, leading to heap based buffer overflow was found in the way the imfile module of rsyslog, an enhanced system logging and kernel message trapping daemon, processed text files larger than 64 KB. When the imfile rsyslog module was enabled, a local attacker could use this flaw to cause denial of service (rsyslogd daemon hang) via specially-crafted message, to be logged.

Upstream bug report: [1] http://bugzilla.adiscon.com/showbug.cgi?id=221

Upstream patch: [2] http://git.adiscon.com/?p=rsyslog.git;a=commit;h=6bad782f154b7f838c7371bf99c13f6dc4ec4101

Description of problem:

If we send to syslog a specially crafted log message, stack guard variable protecting bufParseTAG array in parseLegacySyslogMsg() gets rewritten and rsyslog gets terminated.

Version-Release number of selected component (if applicable):

rsyslog-4.6.2-3.el61.1.i686

How reproducible:

everytime on ia-32 on x86-64 stack guard variable won't get rewritten as it is located 8 bytes above bufParseTAG array

Actual results:

glibc prints the following message and rsyslog gets terminated:

stack smashing detected : rsyslogd terminated

Expected results:

No abortion.

Additional info:

For more info, please, see the following private comment.