Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 584
Alerts This Week
Warning Icon 1 584

Ubuntu 14.04 LTS: USN-2381-1 Critical: Rsyslog Denial Of Service

ubuntu
Calendar Grey October 9, 2014
Scroller Ubuntu
Security issues related to Rsyslog were remedied in Ubuntu Security Notice USN-2381-1, which mitigates failures resulting from malformed data inputs.
Rsyslog could be made to crash if it received specially crafted input.

Summary

Rsyslog could be made to crash if it received specially crafted input.

Software Description:

- rsyslog: Enhanced syslogd

Details:

It was discovered that Rsyslog incorrectly handled invalid PRI values. An

attacker could use this issue to send malformed messages to the Rsyslog

server and cause it to stop responding, resulting in a denial of service

and possibly message loss. (CVE-2014-3634, CVE-2014-3683)

Topics%20covered

Topics Covered

security advisory denial of service ubuntu rsyslog input handling issue

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.04 LTS:
  rsyslog                         7.4.4-1ubuntu2.3

Ubuntu 12.04 LTS:
  rsyslog                         5.8.6-1ubuntu8.9

Ubuntu 10.04 LTS:
  rsyslog                         4.2.0-2ubuntu8.3

In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-2381-1

CVE-2014-3634, CVE-2014-3683

Severity
critical
Lowest
Low
Medium
High
Critical

October 09, 2014

Topics%20covered

Topics Covered

security advisory denial of service ubuntu rsyslog input handling issue

Package Information

https://launchpad.net/ubuntu/+source/rsyslog/7.4.4-1ubuntu2.3
https://launchpad.net/ubuntu/+source/rsyslog/5.8.6-1ubuntu8.9
https://launchpad.net/ubuntu/+source/rsyslog/4.2.0-2ubuntu8.3

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.