Balabit syslog-ng Insecure 'chroot()' Implementation Weakness

Bugtraq ID:	32338
Class:	Design Error
CVE:	CVE-2008-5110
Remote:	No
Local:	Yes
Published:	Nov 17 2008 12:00AM
Updated:	Jul 13 2010 04:17PM
Credit:	Florian Grandel
Vulnerable:	HP Insight Control 6.0 HP Insight Control 0 Gentoo Linux Balabit syslog-ng 2.0.9 Balabit syslog-ng 2.0.6 Balabit syslog-ng 2.0.5 Balabit syslog-ng 2.0.4 Balabit syslog-ng 2.0.3 Balabit syslog-ng 2.0.2 Balabit syslog-ng 2.0.1
Not Vulnerable:	HP Insight Control 6.1

Balabit syslog-ng Insecure 'chroot()' Implementation Weakness

Balabit 'syslog-ng' is prone to a weakness in its use of 'chroot()'.

By executing code as the 'syslog-ng' process, an attacker may be able to take advantage of this weakness to escape the 'chroot()' jail.

This issue affects 'syslog-ng' 2.0.9; other versions may also be affected.

Balabit syslog-ng Insecure 'chroot()' Implementation Weakness

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Balabit syslog-ng Insecure 'chroot()' Implementation Weakness

Solution:
Updates are available; please see the references for more information.

Balabit syslog-ng Insecure 'chroot()' Implementation Weakness

References:

• Debian Bug report logs - #505791 syslog-ng doesn't chdir before chroot (Florian Grandel)
  
• Re: CVE Request (syslog-ng) (Steven M. Christey)
  
• Re: CVE Request (syslog-ng) (Andreas Ericsson)
  
• Re: CVE Request (syslog-ng) (Solar Designer)
  
• syslog-ng Homepage (Balabit)