Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 3 Oct 2014 11:24:43 +0000
From: mancha <mancha1@...o.com>
To: oss-security@...ts.openwall.com
Subject: Re: sysklogd vulnerability (CVE-2014-3634)

On Fri, Oct 03, 2014 at 09:12:28AM +0000, mancha wrote:
> In sysklogd's syslogd, invalid priority values between 192 and 1023
> (directly or arrived at via overflow wraparound) can propagate through
> code causing out-of-bounds access to the f_pmask array within the
> 'filed' structure by up to 104 bytes past its end. Though most likely
> insufficient to reach unallocated memory because there are around 544
> bytes past f_pmask in 'filed' (mod packing and other differences),
> incorrect access of fields at higher positions of the 'filed'
> structure definition can cause unexpected behavior including message
> mis-classification, forwarding issues, message loss, or other.

To expand on the above, because the out-of-bounds access is limited to
the filed structure, the effect on message handling, etc. appears
limited to the would-be attacker's own message. Unlike the more serious
impact seen in rsyslog, my limited testing and code review suggests the
flaw, while there, has no real security impact. Nevertheless, my patch
fixes the handling of malformed PRI parts.

--mancha

Content of type "application/pgp-signature" skipped

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ