syslog-ng Insecure File Permissions Local Privilege Escalation Vulnerability

Bugtraq ID:	45988
Class:	Design Error
CVE:	CVE-2011-0343
Remote:	No
Local:	Yes
Published:	Jan 25 2011 12:00AM
Updated:	Jan 25 2011 12:00AM
Credit:	Steven Chamberlain
Vulnerable:	Balabit syslog-ng Premium Edition 3.2 Balabit syslog-ng Premium Edition 3.0.5 Balabit syslog-ng Open Source Edition 3.2.1 Balabit syslog-ng Open Source Edition 3.1.3 Balabit syslog-ng Open Source Edition 3.0.9 Balabit syslog-ng Open Source Edition 3.0.8 Balabit syslog-ng Open Source Edition 3.0.7 Balabit syslog-ng Open Source Edition 3.2alpha1 Balabit syslog-ng Open Source Edition 3.2
Not Vulnerable:	Balabit syslog-ng Premium Edition 3.0.6 Balabit syslog-ng Premium Edition 3.2.1A Balabit syslog-ng Open Source Edition 3.2.2 Balabit syslog-ng Open Source Edition 3.1.4 Balabit syslog-ng Open Source Edition 3.0.10

syslog-ng Insecure File Permissions Local Privilege Escalation Vulnerability

syslog-ng is prone to a local privilege-escalation vulnerability.

An attacker can exploit this issue to execute arbitrary code with superuser privileges. Successfully exploiting this issue will result in the complete compromise of affected computers.

syslog-ng Insecure File Permissions Local Privilege Escalation Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent
information, please mail us at: [email protected].

syslog-ng Insecure File Permissions Local Privilege Escalation Vulnerability

Solution:
Updates are available. Please see the references for details.

syslog-ng Insecure File Permissions Local Privilege Escalation Vulnerability

References:

• syslog-ng Homepage (Balabit)