Hide Forgot
Description of problem: A vulnerability has been found in rsyslog's ACL handling. Due to a coding error in the modularization effort, the $AllowedSender directive is no longer honored but silently accepted. As such, rsyslog-based access control via $AllowedSender is not working and messages from every sender will be accepted by rsyslog. Most importantly, this could lead to misleading log entries or a remote DoS, by a malicious sender simply flooding the system logs with messages until the system runs out of disk space.
Security Advisory: http://www.rsyslog.com/Article322.phtml
rsyslog-3.20.2-2.fc9 has been submitted as an update for Fedora 9. http://admin.fedoraproject.org/updates/rsyslog-3.20.2-2.fc9
CVE id CVE-2008-5617 was assigned to this issue: The ACL handling in rsyslog 3.12.1 to 3.20.0, 4.1.0, and 4.1.1 does not follow $AllowedSender directive, which allows remote attackers to bypass intended access restrictions and spoof log messages or create a large number of spurious messages. References: http://www.rsyslog.com/Article322.phtml http://www.rsyslog.com/Topic4.phtml
This issue did not affect the version of the rsyslog package, as shipped with Red Hat Enterprise Linux 5.
rsyslog-3.20.2-2.fc9 has been pushed to the Fedora 9 stable repository. If problems still persist, please make note of it in this bug report.
rsyslog-3.21.9-1.fc10 has been pushed to the Fedora 10 stable repository. If problems still persist, please make note of it in this bug report.
This issue was addressed in: Fedora: https://admin.fedoraproject.org/updates/F10/FEDORA-2008-11476 https://admin.fedoraproject.org/updates/F9/FEDORA-2008-11538