CVE-2008-5617 The ACL handling in rsyslog 3.12.1 to 3.20.0, 4.1.0, and 4.1.1 does not follow $AllowedSender directive, which allows remote attackers to bypass intended access restrictions and spoof log messages or....
HighCVSS 8.5
EPSS 2.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The ACL handling in rsyslog 3.12.1 to 3.20.0, 4.1.0, and 4.1.1 does not follow $AllowedSender directive, which allows remote attackers to bypass intended access restrictions and spoof log messages or create a large number of spurious messages.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| rsyslog | = 3.12.1 | No fix listed |
| rsyslog | = 3.12.2 | No fix listed |
| rsyslog | = 3.12.3 | No fix listed |
| rsyslog | = 3.12.4 | No fix listed |
| rsyslog | = 3.12.5 | No fix listed |
| rsyslog | = 3.13.0 | No fix listed |
| rsyslog | = 3.15.0 | No fix listed |
| rsyslog | = 3.15.1-beta | No fix listed |
| rsyslog | = 3.17.0 | No fix listed |
| rsyslog | = 3.17.1 | No fix listed |
| rsyslog | = 3.17.4-beta | No fix listed |
| rsyslog | = 3.17.5-beta | No fix listed |
| rsyslog | = 3.19.0 | No fix listed |
| rsyslog | = 3.19.1 | No fix listed |
| rsyslog | = 3.19.2 | No fix listed |
| rsyslog | = 3.19.3 | No fix listed |
| rsyslog | = 3.19.4 | No fix listed |
| rsyslog | = 3.19.5 | No fix listed |
| rsyslog | = 3.19.6 | No fix listed |
| rsyslog | = 3.19.7 | No fix listed |
| rsyslog | = 3.19.8 | No fix listed |
| rsyslog | = 3.19.9 | No fix listed |
| rsyslog | = 3.19.10 | No fix listed |
| rsyslog | = 3.19.11 | No fix listed |
| rsyslog | = 3.19.12 | No fix listed |
Show 6 more
| Product | Affected versions | Fixed in |
|---|---|---|
| rsyslog | = 3.20.0 | No fix listed |
| rsyslog | = 4.1.0 | No fix listed |
| rsyslog | = 4.1.1 | No fix listed |
| debian/rsyslog(Debian:12) | < 3.18.6-1 | 3.18.6-1 |
| debian/rsyslog(Debian:13) | < 3.18.6-1 | 3.18.6-1 |
| debian/rsyslog(Debian:14) | < 3.18.6-1 | 3.18.6-1 |
References
- 32857 third-party-advisory vendor-advisory
- www.rsyslog.com patch vendor-advisory
- www.rsyslog.com
- www.rsyslog.com
- 32630 vdb-entry
- rsyslog-allowedsender-security-bypass(47080) vdb-entry
- Debian Security Tracker CVE-2008-5617 vendor-advisory
- bugs.debian.org issue-tracking