Executive Summary

Summary
Title Syslog-ng: Chroot escape
Informations
Name GLSA-200907-10 First vendor Publication 2009-07-12
Vendor Gentoo Last vendor Modification 2009-07-12
Severity (Vendor) Low Revision N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:C/I:C/A:C)
Cvss Base Score 9.3 Attack Range Network
Cvss Impact Score 10 Attack Complexity Medium
Cvss Expoit Score 8.6 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Synopsis

Syslog-ng does not properly initialize its chroot jail allowing for an escape if a separate vulnerability in Syslog-ng is exploited.

Background

Syslog-ng is a flexible and scalable system logger.

Description

Florian Grandel reported that Syslog-ng does not call chdir() before chroot() which leads to an inherited file descriptor to the current working directory.

Impact

A local attacker might exploit a separate vulnerability in Syslog-ng and use this vulnerability to escape the chroot jail.

Workaround

There is no known workaround at this time.

Resolution

All Syslog-ng 2.0 users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=app-admin/syslog-ng-2.0.10"

All Syslog-ng 2.1 users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=app-admin/syslog-ng-2.1.3"

References

[ 1 ] CVE-2008-5110 : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5110

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-200907-10.xml

Original Source

Url : http://security.gentoo.org/glsa/glsa-200907-10.xml

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 14

OpenVAS Exploits

Date Description
2009-07-29 Name : Gentoo Security Advisory GLSA 200907-10 (syslog-ng)
File : nvt/glsa_200907_10.nasl
2009-02-16 Name : Fedora Update for syslog-ng FEDORA-2008-10752
File : nvt/gb_fedora_2008_10752_syslog-ng_fc9.nasl
2009-02-16 Name : Fedora Update for syslog-ng FEDORA-2008-10879
File : nvt/gb_fedora_2008_10879_syslog-ng_fc10.nasl
2009-02-16 Name : Fedora Update for syslog-ng FEDORA-2008-10920
File : nvt/gb_fedora_2008_10920_syslog-ng_fc8.nasl
2008-11-24 Name : FreeBSD Ports: syslog-ng2
File : nvt/freebsd_syslog-ng2.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
50327 syslog-ng chroot chdir Call Jailed Directory Weakness

Nessus® Vulnerability Scanner

Date Description
2009-07-13 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-200907-10.nasl - Type : ACT_GATHER_INFO
2009-04-23 Name : The remote Fedora host is missing a security update.
File : fedora_2008-10879.nasl - Type : ACT_GATHER_INFO
2008-12-08 Name : The remote Fedora host is missing a security update.
File : fedora_2008-10752.nasl - Type : ACT_GATHER_INFO
2008-12-08 Name : The remote Fedora host is missing a security update.
File : fedora_2008-10920.nasl - Type : ACT_GATHER_INFO
2008-11-19 Name : The remote FreeBSD host is missing one or more security-related updates.
File : freebsd_pkg_75f2382eb58611dd95f900e0815b8da8.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
Date Informations
2014-02-17 11:36:36
  • Multiple Updates