Lucene search

K
amazonAmazonALAS2-2020-1447
HistoryJun 26, 2020 - 10:55 p.m.

Medium: rsyslog

2020-06-2622:55:00
alas.aws.amazon.com
36

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.7 High

AI Score

Confidence

High

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.007 Low

EPSS

Percentile

80.1%

Issue Overview:

An issue was discovered in Rsyslog v8.1908.0. contrib/pmaixforwardedfrom/pmaixforwardedfrom.c has a heap overflow in the parser for AIX log messages. The parser tries to locate a log message delimiter (in this case, a space or a colon) but fails to account for strings that do not satisfy this constraint. If the string does not match, then the variable lenMsg will reach the value zero and will skip the sanity check that detects invalid log messages. The message will then be considered valid, and the parser will eat up the nonexistent colon delimiter. In doing so, it will decrement lenMsg, a signed integer, whose value was zero and now becomes minus one. The following step in the parser is to shift left the contents of the message. To do this, it will call memmove with the right pointers to the target and destination strings, but the lenMsg will now be interpreted as a huge value, causing a heap overflow. (CVE-2019-17041)

An issue was discovered in Rsyslog v8.1908.0. contrib/pmcisconames/pmcisconames.c has a heap overflow in the parser for Cisco log messages. The parser tries to locate a log message delimiter (in this case, a space or a colon), but fails to account for strings that do not satisfy this constraint. If the string does not match, then the variable lenMsg will reach the value zero and will skip the sanity check that detects invalid log messages. The message will then be considered valid, and the parser will eat up the nonexistent colon delimiter. In doing so, it will decrement lenMsg, a signed integer, whose value was zero and now becomes minus one. The following step in the parser is to shift left the contents of the message. To do this, it will call memmove with the right pointers to the target and destination strings, but the lenMsg will now be interpreted as a huge value, causing a heap overflow. (CVE-2019-17042)

Affected Packages:

rsyslog

Note:

This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.

Issue Correction:
Run yum update rsyslog to update your system.

New Packages:

aarch64:  
    rsyslog-8.24.0-52.amzn2.aarch64  
    rsyslog-crypto-8.24.0-52.amzn2.aarch64  
    rsyslog-elasticsearch-8.24.0-52.amzn2.aarch64  
    rsyslog-mmjsonparse-8.24.0-52.amzn2.aarch64  
    rsyslog-mmnormalize-8.24.0-52.amzn2.aarch64  
    rsyslog-mmaudit-8.24.0-52.amzn2.aarch64  
    rsyslog-mmsnmptrapd-8.24.0-52.amzn2.aarch64  
    rsyslog-libdbi-8.24.0-52.amzn2.aarch64  
    rsyslog-mysql-8.24.0-52.amzn2.aarch64  
    rsyslog-pgsql-8.24.0-52.amzn2.aarch64  
    rsyslog-gssapi-8.24.0-52.amzn2.aarch64  
    rsyslog-relp-8.24.0-52.amzn2.aarch64  
    rsyslog-gnutls-8.24.0-52.amzn2.aarch64  
    rsyslog-snmp-8.24.0-52.amzn2.aarch64  
    rsyslog-udpspoof-8.24.0-52.amzn2.aarch64  
    rsyslog-kafka-8.24.0-52.amzn2.aarch64  
    rsyslog-mmkubernetes-8.24.0-52.amzn2.aarch64  
    rsyslog-debuginfo-8.24.0-52.amzn2.aarch64  
  
i686:  
    rsyslog-8.24.0-52.amzn2.i686  
    rsyslog-crypto-8.24.0-52.amzn2.i686  
    rsyslog-elasticsearch-8.24.0-52.amzn2.i686  
    rsyslog-mmjsonparse-8.24.0-52.amzn2.i686  
    rsyslog-mmnormalize-8.24.0-52.amzn2.i686  
    rsyslog-mmaudit-8.24.0-52.amzn2.i686  
    rsyslog-mmsnmptrapd-8.24.0-52.amzn2.i686  
    rsyslog-libdbi-8.24.0-52.amzn2.i686  
    rsyslog-mysql-8.24.0-52.amzn2.i686  
    rsyslog-pgsql-8.24.0-52.amzn2.i686  
    rsyslog-gssapi-8.24.0-52.amzn2.i686  
    rsyslog-relp-8.24.0-52.amzn2.i686  
    rsyslog-gnutls-8.24.0-52.amzn2.i686  
    rsyslog-snmp-8.24.0-52.amzn2.i686  
    rsyslog-udpspoof-8.24.0-52.amzn2.i686  
    rsyslog-kafka-8.24.0-52.amzn2.i686  
    rsyslog-mmkubernetes-8.24.0-52.amzn2.i686  
    rsyslog-debuginfo-8.24.0-52.amzn2.i686  
  
noarch:  
    rsyslog-doc-8.24.0-52.amzn2.noarch  
  
src:  
    rsyslog-8.24.0-52.amzn2.src  
  
x86_64:  
    rsyslog-8.24.0-52.amzn2.x86_64  
    rsyslog-crypto-8.24.0-52.amzn2.x86_64  
    rsyslog-elasticsearch-8.24.0-52.amzn2.x86_64  
    rsyslog-mmjsonparse-8.24.0-52.amzn2.x86_64  
    rsyslog-mmnormalize-8.24.0-52.amzn2.x86_64  
    rsyslog-mmaudit-8.24.0-52.amzn2.x86_64  
    rsyslog-mmsnmptrapd-8.24.0-52.amzn2.x86_64  
    rsyslog-libdbi-8.24.0-52.amzn2.x86_64  
    rsyslog-mysql-8.24.0-52.amzn2.x86_64  
    rsyslog-pgsql-8.24.0-52.amzn2.x86_64  
    rsyslog-gssapi-8.24.0-52.amzn2.x86_64  
    rsyslog-relp-8.24.0-52.amzn2.x86_64  
    rsyslog-gnutls-8.24.0-52.amzn2.x86_64  
    rsyslog-snmp-8.24.0-52.amzn2.x86_64  
    rsyslog-udpspoof-8.24.0-52.amzn2.x86_64  
    rsyslog-kafka-8.24.0-52.amzn2.x86_64  
    rsyslog-mmkubernetes-8.24.0-52.amzn2.x86_64  
    rsyslog-debuginfo-8.24.0-52.amzn2.x86_64  

Additional References

Red Hat: CVE-2019-17041, CVE-2019-17042

Mitre: CVE-2019-17041, CVE-2019-17042

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.7 High

AI Score

Confidence

High

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.007 Low

EPSS

Percentile

80.1%

Related for ALAS2-2020-1447