Bug 981719 (CVE-2013-4758) - CVE-2013-4758 rsyslog: double free flaw in ElasticSearch plugin
Summary: CVE-2013-4758 rsyslog: double free flaw in ElasticSearch plugin
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2013-4758
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 981722
TreeView+ depends on / blocked
 
Reported: 2013-07-05 15:10 UTC by Stefan Cornelius
Modified: 2021-02-17 07:32 UTC (History)
2 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2013-07-08 03:47:09 UTC
Embargoed:


Attachments (Terms of Use)

Description Stefan Cornelius 2013-07-05 15:10:34 UTC
A double free flaw was found in the way the ElasticSearch plugin of rsyslog handled JSON response from ElasticSearch. If the "errorfile" parameter is explicitely set for local logging and a an attacker can manipulate the JSON response from ElasticSearch, the attacker could cause rsyslog to crash or, possibly, execute arbitrary code with the privileges of rsyslog.

References:
[1] http://www.lsexperts.de/advisories/lse-2013-07-03.txt

Upstream bug report:
[2] http://bugzilla.adiscon.com/show_bug.cgi?id=461

Comment 2 Huzaifa S. Sidhpurwala 2013-07-08 03:44:11 UTC
The version of rsyslog shipped with Red Hat Enterprise Linux 5 and 6, does not contain the vulnerable omelasticsearch plugin and therefore is not vulnerable to this flaw.

The version of rsyslog shipped with Fedora 18 and Fedora 19, does not contain the vulnerable omelasticsearch plugin and therefore is not vulnerable to this flaw.

Comment 3 Huzaifa S. Sidhpurwala 2013-07-08 03:44:56 UTC
Statement:

Not Vulnerable. This issue does not affect the version of rsyslog as shipped with Red Hat Enterprise Linux 5 and 6.


Note You need to log in before you can comment on or make changes to this bug.