Test ID:	1.3.6.1.4.1.25623.1.0.891952
Category:	Debian Local Security Checks
Title:	Debian: Security Advisory (DLA-1952-1)
Summary:	The remote host is missing an update for the Debian 'rsyslog' package(s) announced via the DLA-1952-1 advisory.
Description:	Summary: The remote host is missing an update for the Debian 'rsyslog' package(s) announced via the DLA-1952-1 advisory. Vulnerability Insight: It was discovered that there were two vulnerabilities in the rsyslog system/kernel logging daemon in the parsers for AIX and Cisco log messages respectfully. CVE-2019-17041 An issue was discovered in Rsyslog v8.1908.0. contrib/pmaixforwardedfrom/pmaixforwardedfrom.c has a heap overflow in the parser for AIX log messages. The parser tries to locate a log message delimiter (in this case, a space or a colon) but fails to account for strings that do not satisfy this constraint. If the string does not match, then the variable lenMsg will reach the value zero and will skip the sanity check that detects invalid log messages. The message will then be considered valid, and the parser will eat up the nonexistent colon delimiter. In doing so, it will decrement lenMsg, a signed integer, whose value was zero and now becomes minus one. The following step in the parser is to shift left the contents of the message. To do this, it will call memmove with the right pointers to the target and destination strings, but the lenMsg will now be interpreted as a huge value, causing a heap overflow. CVE-2019-17042 An issue was discovered in Rsyslog v8.1908.0. contrib/pmcisconames/pmcisconames.c has a heap overflow in the parser for Cisco log messages. The parser tries to locate a log message delimiter (in this case, a space or a colon), but fails to account for strings that do not satisfy this constraint. If the string does not match, then the variable lenMsg will reach the value zero and will skip the sanity check that detects invalid log messages. The message will then be considered valid, and the parser will eat up the nonexistent colon delimiter. In doing so, it will decrement lenMsg, a signed integer, whose value was zero and now becomes minus one. The following step in the parser is to shift left the contents of the message. To do this, it will call memmove with the right pointers to the target and destination strings, but the lenMsg will now be interpreted as a huge value, causing a heap overflow. For Debian 8 Jessie, these problems have been fixed in version 8.4.2-1+deb8u3. We recommend that you upgrade your rsyslog packages. Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: [link moved to references] Affected Software/OS: 'rsyslog' package(s) on Debian 8. Solution: Please install the updated package(s). CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2019-17041 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KPNCHI7X2IEXRH6RYD6IDPR4PLB5RPC7/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W6SUQE25RD37CD24BHKUWMG27U5RQ2FU/ https://lists.debian.org/debian-lts-announce/2021/11/msg00030.html SuSE Security Announcement: openSUSE-SU-2019:2500 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00031.html SuSE Security Announcement: openSUSE-SU-2019:2501 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00032.html Common Vulnerability Exposure (CVE) ID: CVE-2019-17042
Copyright	Copyright (C) 2019 Greenbone AG

This is only one of 146377 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.