full-disclosure - [ MDVSA-2012:100 ] rsyslog

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <E1Sj9B2-0001wU-Id@titan.mandriva.com>
Date: Mon, 25 Jun 2012 15:18:00 +0200
From: security@...driva.com
To: full-disclosure@...ts.grok.org.uk
Subject: [ MDVSA-2012:100 ] rsyslog

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2012:100
 http://www.mandriva.com/security/
 _______________________________________________________________________

 Package : rsyslog
 Date    : June 25, 2012
 Affected: 2010.1
 _______________________________________________________________________

 Problem Description:

 A vulnerability has been discovered and corrected in rsyslog:
 
 An integer signedness error, leading to heap based buffer overflow
 was found in the way the imfile module of rsyslog, an enhanced
 system logging and kernel message trapping daemon, processed text
 files larger than 64 KB. When the imfile rsyslog module was enabled,
 a local attacker could use this flaw to cause denial of service
 (rsyslogd daemon hang) via specially-crafted message, to be logged
 (CVE-2011-4623).
 
 The updated packages have been patched to correct this issue.
 _______________________________________________________________________

 References:

 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4623
 _______________________________________________________________________

 Updated Packages:

 Mandriva Linux 2010.1:
 380e112c14082d15cca5e1bb9919f582  2010.1/i586/rsyslog-4.6.2-3.2mdv2010.2.i586.rpm
 0a485101e3f92899262a8d3082d3810f  2010.1/i586/rsyslog-dbi-4.6.2-3.2mdv2010.2.i586.rpm
 5d48f21f67c1a84ef66e19288ae9567a  2010.1/i586/rsyslog-docs-4.6.2-3.2mdv2010.2.i586.rpm
 80315f1b7f422b6b01fef01813e41821  2010.1/i586/rsyslog-gssapi-4.6.2-3.2mdv2010.2.i586.rpm
 9a341e46b5f367c9b8b7dfdc7a989db4  2010.1/i586/rsyslog-mysql-4.6.2-3.2mdv2010.2.i586.rpm
 6b6c0b4d0f5f2ebf2d376fa8c6c62049  2010.1/i586/rsyslog-pgsql-4.6.2-3.2mdv2010.2.i586.rpm
 3e8209ad7b579dd01f0981e78df8f6f9  2010.1/i586/rsyslog-relp-4.6.2-3.2mdv2010.2.i586.rpm
 2fe8bc6badc5dd5dfbe59b781abdd418  2010.1/i586/rsyslog-snmp-4.6.2-3.2mdv2010.2.i586.rpm 
 9b56fe39f76363e49aef31175980402a  2010.1/SRPMS/rsyslog-4.6.2-3.2mdv2010.2.src.rpm

 Mandriva Linux 2010.1/X86_64:
 80aced08b93cf7362140d6ccec9f6ccc  2010.1/x86_64/rsyslog-4.6.2-3.2mdv2010.2.x86_64.rpm
 b99fac44b5f5c7577046bed76902c286  2010.1/x86_64/rsyslog-dbi-4.6.2-3.2mdv2010.2.x86_64.rpm
 b5020d7f1ab2c0af693d8d900fa89f5d  2010.1/x86_64/rsyslog-docs-4.6.2-3.2mdv2010.2.x86_64.rpm
 362b0e0550acc8485426fb3786c8fe6e  2010.1/x86_64/rsyslog-gssapi-4.6.2-3.2mdv2010.2.x86_64.rpm
 7ebd4c311d0321fa1890939b0de43c3a  2010.1/x86_64/rsyslog-mysql-4.6.2-3.2mdv2010.2.x86_64.rpm
 be3a1b1029de820708559545d37424e7  2010.1/x86_64/rsyslog-pgsql-4.6.2-3.2mdv2010.2.x86_64.rpm
 11d4ec93b3d8e3e445da2a07a95fd4fc  2010.1/x86_64/rsyslog-relp-4.6.2-3.2mdv2010.2.x86_64.rpm
 8e5b6cedca81e23d5c7a0cc580f666b6  2010.1/x86_64/rsyslog-snmp-4.6.2-3.2mdv2010.2.x86_64.rpm 
 9b56fe39f76363e49aef31175980402a  2010.1/SRPMS/rsyslog-4.6.2-3.2mdv2010.2.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iD8DBQFP6DlLmqjQ0CJFipgRAiTLAJ4kgiHE0CUbzO1YRIP/18FMgLNh1wCdFmey
wvdYm6ytB01GvBxJN34aMQk=
=04hW
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/