Denial of service in rsyslog

1) Input validation error

EUVDB-ID: #VU17698

Risk: Low

CVSSv4.0: 5.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/U:Clear]

CVE-ID: CVE-2018-16881

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists in the imptcp module due to insufficient validation of user-supplied input. A remote attacker can send a specially crafted message to the imptcp socket that submits malicious input and cause the affected software to crash, resulting in a DoS condition.

Mitigation

Update to version 8.27.

Vulnerable software versions

rsyslog: 8.1.0 - 8.26

CPE2.3

• cpe:2.3:a:rsyslog_com:rsyslog:8.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:rsyslog_com:rsyslog:8.1.1:*:*:*:*:*:*:*
• cpe:2.3:a:rsyslog_com:rsyslog:8.1.2:*:*:*:*:*:*:*

External links

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16881

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.