Bug 1481335 (CVE-2017-12588)

Summary:	CVE-2017-12588 rsyslog: multiple format string vulnerabilities in zmq3 modules
Product:	[Other] Security Response	Reporter:	Pedro Sampaio <psampaio>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	dkholia, dkopecek, jlieskov, jvymazal, lkundrak, mah.darade, pvrabec, rsroka, sdordevi, slawomir, tosykora
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	Multiple format string vulnerabilities were found in the zmq3 modules in rsyslog. A local attacker could potentially use these flaws to crash the rsyslog daemon under certain circumstances.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2017-08-17 07:37:42 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1481340

Description Pedro Sampaio 2017-08-14 15:50:27 UTC

The zmq3 input and output modules in rsyslog before 8.28.0 interpreted description fields as format strings, possibly allowing a format string attack. These format string vulnerabilities were found in function 'initZMQ' in omzmq3.c file and in function 'createSocket' in imzmq3.c file.

Upstream bug:

https://github.com/rsyslog/rsyslog/pull/1565

Upstream patch:

https://github.com/rsyslog/rsyslog/commit/062d0c671a29f7c6f7dff4a2f1f35df375bbb30b

Bug introduced in:

https://github.com/rsyslog/rsyslog/commit/cbff73d94c3a86ed74294fe1265dc5242f9317be

The first affected version is 6.5.0.

References:

https://bugzilla.novell.com/show_bug.cgi?id=1051798

Comment 1 Radovan Sroka 2017-08-15 07:34:03 UTC

We do not compile these modules.

--enable-imzmq3         Compiles imzmq3 output module [default=no]
--enable-omzmq3         Compiles omzmq3 output module [default=no]

Configure is running without any related option.
This is the same on RHEL and fedora.

Comment 3 Dhiru Kholia 2017-08-17 07:12:49 UTC

Statement:

This issue did not affect the versions of rsyslog as shipped with Red Hat Enterprise Linux 5, 6, and 7.