CVE-2008-5618 imudp in rsyslog 4.x before 4.1.2, 3.21 before 3.21.9 beta, and 3.20 before 3.20.2 generates a message even when it is sent by an unauthorized sender, which allows remote attackers to cause a denial o...
MediumCVSS 5.0
EPSS 1.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
imudp in rsyslog 4.x before 4.1.2, 3.21 before 3.21.9 beta, and 3.20 before 3.20.2 generates a message even when it is sent by an unauthorized sender, which allows remote attackers to cause a denial of service (disk consumption) via a large number of spurious messages.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| rsyslog | = 3.12.1 | No fix listed |
| rsyslog | = 3.20.0 | No fix listed |
| rsyslog | = 4.1.0 | No fix listed |
| rsyslog | = 4.1.1 | No fix listed |
| debian/rsyslog(Debian:12) | < 3.18.6-1 | 3.18.6-1 |
| debian/rsyslog(Debian:13) | < 3.18.6-1 | 3.18.6-1 |
| debian/rsyslog(Debian:14) | < 3.18.6-1 | 3.18.6-1 |
References
- www.rsyslog.com
- Debian Security Tracker CVE-2008-5618 vendor-advisory
- bugs.debian.org issue-tracking