BugTraq
[ MDVSA-2012:100 ] rsyslog Jun 25 2012 01:18PM
security mandriva com
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDVSA-2012:100
http://www.mandriva.com/security/
_______________________________________________________________________

Package : rsyslog
Date : June 25, 2012
Affected: 2010.1
_______________________________________________________________________

Problem Description:

A vulnerability has been discovered and corrected in rsyslog:

An integer signedness error, leading to heap based buffer overflow
was found in the way the imfile module of rsyslog, an enhanced
system logging and kernel message trapping daemon, processed text
files larger than 64 KB. When the imfile rsyslog module was enabled,
a local attacker could use this flaw to cause denial of service
(rsyslogd daemon hang) via specially-crafted message, to be logged
(CVE-2011-4623).

The updated packages have been patched to correct this issue.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4623
_______________________________________________________________________

Updated Packages:

Mandriva Linux 2010.1:
380e112c14082d15cca5e1bb9919f582 2010.1/i586/rsyslog-4.6.2-3.2mdv2010.2.i586.rpm
0a485101e3f92899262a8d3082d3810f 2010.1/i586/rsyslog-dbi-4.6.2-3.2mdv2010.2.i586.rpm
5d48f21f67c1a84ef66e19288ae9567a 2010.1/i586/rsyslog-docs-4.6.2-3.2mdv2010.2.i586.rpm
80315f1b7f422b6b01fef01813e41821 2010.1/i586/rsyslog-gssapi-4.6.2-3.2mdv2010.2.i586.rpm
9a341e46b5f367c9b8b7dfdc7a989db4 2010.1/i586/rsyslog-mysql-4.6.2-3.2mdv2010.2.i586.rpm
6b6c0b4d0f5f2ebf2d376fa8c6c62049 2010.1/i586/rsyslog-pgsql-4.6.2-3.2mdv2010.2.i586.rpm
3e8209ad7b579dd01f0981e78df8f6f9 2010.1/i586/rsyslog-relp-4.6.2-3.2mdv2010.2.i586.rpm
2fe8bc6badc5dd5dfbe59b781abdd418 2010.1/i586/rsyslog-snmp-4.6.2-3.2mdv2010.2.i586.rpm
9b56fe39f76363e49aef31175980402a 2010.1/SRPMS/rsyslog-4.6.2-3.2mdv2010.2.src.rpm

Mandriva Linux 2010.1/X86_64:
80aced08b93cf7362140d6ccec9f6ccc 2010.1/x86_64/rsyslog-4.6.2-3.2mdv2010.2.x86_64.rpm
b99fac44b5f5c7577046bed76902c286 2010.1/x86_64/rsyslog-dbi-4.6.2-3.2mdv2010.2.x86_64.rpm
b5020d7f1ab2c0af693d8d900fa89f5d 2010.1/x86_64/rsyslog-docs-4.6.2-3.2mdv2010.2.x86_64.rpm
362b0e0550acc8485426fb3786c8fe6e 2010.1/x86_64/rsyslog-gssapi-4.6.2-3.2mdv2010.2.x86_64.rpm
7ebd4c311d0321fa1890939b0de43c3a 2010.1/x86_64/rsyslog-mysql-4.6.2-3.2mdv2010.2.x86_64.rpm
be3a1b1029de820708559545d37424e7 2010.1/x86_64/rsyslog-pgsql-4.6.2-3.2mdv2010.2.x86_64.rpm
11d4ec93b3d8e3e445da2a07a95fd4fc 2010.1/x86_64/rsyslog-relp-4.6.2-3.2mdv2010.2.x86_64.rpm
8e5b6cedca81e23d5c7a0cc580f666b6 2010.1/x86_64/rsyslog-snmp-4.6.2-3.2mdv2010.2.x86_64.rpm
9b56fe39f76363e49aef31175980402a 2010.1/SRPMS/rsyslog-4.6.2-3.2mdv2010.2.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/security/advisories

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iD8DBQFP6DlLmqjQ0CJFipgRAiTLAJ4kgiHE0CUbzO1YRIP/18FMgLNh1wCdFmey
wvdYm6ytB01GvBxJN34aMQk=
=04hW
-----END PGP SIGNATURE-----

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus