ArchLinux: 201410-5: rsyslog: remote denial of service
Summary
The rsyslog fix shipped in 8.4.1 for an invalid PRI value (see
ASA-201410-1) was incomplete, as it did not cover cases where PRI values
> MAX_INT. These values caused an integer overflow, resulting in
negative values.
Sending a syslog message containing an invalid PRI value to a vulnerable
rsyslog server accepting remote message will trigger a denial of service
by crashing the rsyslog process.
Resolution
Upgrade to 8.4.2-1.
# pacman -Syu "rsyslog>=8.4.2-1"
The problem has been fixed upstream in version 8.4.2.
References
[1] https://www.rsyslog.com/remote-syslog-pri-vulnerability-cve-2014-3683/ http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3683
![Dist Arch](/images/distros/dist-arch.png)
Workaround
It is possible to prevent unauthorized remote hosts from sending syslog messages to vulnerable hosts, for example by using a firewall.