OpenBSD False syslogd Source IP Reporting Weakness

Bugtraq ID:	6219
Class:	Design Error
CVE:
Remote:	No
Local:	No
Published:	Nov 21 2002 12:00AM
Updated:	Nov 21 2002 12:00AM
Credit:	Discovery credited to "Torsten Valentin" <[email protected]>.
Vulnerable:	OpenBSD OpenBSD 2.9 OpenBSD OpenBSD 3.2 OpenBSD OpenBSD 3.1 OpenBSD OpenBSD 3.0
Not Vulnerable:

OpenBSD False syslogd Source IP Reporting Weakness

A weakness in the remote reporting functionality of syslogd has been discovered.

It is possible for syslog to send false information to a remote syslogd server. This problem occurs when a host has its IP address reconfigured and is not then rebooted. In this situation, any logs generated by syslog on the recently reconfigured host, will be sent to a remote syslog server with the previous IP address and not the currently configured IP address.

OpenBSD False syslogd Source IP Reporting Weakness

There is no exploit code required.

OpenBSD False syslogd Source IP Reporting Weakness

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

OpenBSD False syslogd Source IP Reporting Weakness

References:

• OpenBSD Homepage (OpenBSD)
  
• [OpenBSD] [syslogd] false src-IP when logging to remote syslogd ("Torsten Valentin" )