SourceMage Grimoire Bug List

[bugzilla-daemon AT bugs.sourcemage.org]

http://bugs.sourcemage.org/show_bug.cgi?id=14940

           Summary: utils/rsyslog: security vulnerability in $AllowedSender
                    mechanism
           Product: Codex
           Version: stable-rc grimoire
          Platform: x86
               URL: http://www.rsyslog.com/Article322.phtml
        OS/Version: Linux
            Status: NEW
          Severity: major
          Priority: P4
         Component: utils
        AssignedTo: sm-grimoire-bugs AT lists.ibiblio.org
        ReportedBy: ryuji AT sourcemage.org



Elisamuel Resto <ryuji AT sourcemage.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
               Flag|                            |fixed_in_lesser_branch+,
                   |                            |integrate_to_stable-
                   |                            |rc_grimoire?,
                   |                            |integrate_to_stable_grimoire
                   |                            |?


A security flaw was in rsyslog's mechanism for $AllowedSender that was
introduced during the code modularization efforts. The vulnerability, as
described, caused rsyslog to be silently accepted, but not honored. This issue
could also potentially lead to a DoS attack due to the fact that all sendings
hosts would be allowed through and the system logs to be flooded by a 
attacker.

The versions affected are rsyslog 3.12.1 to 3.20.0, 4.1.0 and 4.1.1. The
v2-stable branch is not affected. The vulnerability can be fully mitigated by
moving the access control to the firewall level. This is recommended in any
case, not just as a mitigation (see reasoning above).

This has been fixed in test with commit
fbe2cd83b3acab428f5e6f6ae0d4a445a04925f5. For stable, this fix might require
commit 89ddb1478b1a54c7d07b211c69d166c0a2eab850 to be applied before (the only
difference between current stable and stable-rc for this spell).

Requesting integration to stable-rc-0.28 and stable-0.27.


-- 
Configure bugmail: http://bugs.sourcemage.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.