#VU17698 Input validation error in rsyslog - CVE-2018-16881

Vulnerability identifier: #VU17698

Vulnerability risk: Low

CVSSv4.0: 5.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/U:Clear]

CVE-ID: CVE-2018-16881

CWE-ID: CWE-20

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
rsyslog
Server applications / Other server solutions

Vendor: rsyslog.com

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists in the imptcp module due to insufficient validation of user-supplied input. A remote attacker can send a specially crafted message to the imptcp socket that submits malicious input and cause the affected software to crash, resulting in a DoS condition.

Mitigation
Update to version 8.27.

Vulnerable software versions

rsyslog: 8.1.0 - 8.26

---

External links
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16881

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.