======================================================================== == syslog-ng 2.0, 3.0, 3.1, 3.2 OSE and PE <= Information leak, access prevention and possible priviledge escalation CVE-2011-0343 ======================================================================== == 1. OVERVIEW Versions 3.0, 3.1 and 3.2 of syslog-ng Open Source Edition (OSE) and versions 3.0, 3.1 and 3.2 of syslog-ng Premium Edition (PE) create log files with all permission bit set by default on FreeBSD and HP-UX architectures. These permissions allow anybody with local access to read and write the log files. The setuid and execution bits are also set, allowing the log files to be executed. 2. BACKGROUND The syslog-ng application is an enhanced version of the default Syslog service found on FreeBSD and other UNIX and Unix-like operating systems. The syslog- ng application supports reliable and encrypted transport using TCP and TLS, SQL support, and offers powerful message filtering, sorting, pre-processing and log normalization capabilities. Utilizing message parsing and classification, syslog-ng is able to correlate log messages both real-time and offline, making it especially suited to implement the artificial ignorance principle. 3. VULNERABILITY DESCRIPTION This vulnerability affects only architectures where sizeof(mod_t) is not equal to sizeof(int). Because of bad casts in the code and the internal representation of the ``use the default permission'' setting being -1, this number in the chmod call is interpreted as 07777. This means that the permission of the file is readable, writable and executable to all, and the setuid, setgid, and sticky bits are set. Everybody who can see the file can read it, write it and even run it with root permission. 4. VERSIONS AFFECTED The following table summarizes in which product versions is the vulnerable code present and in which versions has it been corrected. syslog-ng Open Source Edition (OSE): Branch Vulnerable from Fixed in 2.0.X this branch is not vulnerable 3.0.X 3.0.7 3.0.10 3.1.X 3.1.3 3.1.4 3.2.X 3.2alpha1 3.2.2? syslog-ng Premium Edition (PE): Branch Vulnerable from Fixed in 3.0.X 3.0.6 3.0.6a 3.1.X this branch is not vulnerable 3.2.X 3.2.0 3.2.1a 5. PROOF-OF-CONCEPT/EXPLOIT None. But it's easy to imagine. 6. IMPACT This problem causes that every user can see, modify or destroy the log messages directly and make it difficult to detect harmful operations. With a small trick even (shell)code execution is possible with root permissions, causing privilege escalation. 7. SOLUTION Upgrade to a newer, unaffected version. syslog-ng Open Source Edition (OSE): 3.0.X 3.0.10 3.1.X 3.1.4 3.2.X 3.2.2 syslog-ng Premium Edition (PE): 3.0.X 3.0.6a 3.2.X 3.2.1a 8. VENDOR BalaBit IT Security Ltd. http://www.balabit.com Product page: http://www.balabit.com/network-security/syslog-ng/ 9. CREDIT This vulnerability was discovered by Steven Chamberlain steven :at: pyro dot eu dot org 10. DISCLOSURE TIME-LINE 2010-12-31: The problem reported to the debian bug tracking system 2010-12-31: notified vendor by the debian maintainer 2011-01-01: upstream proposed a fix 2011-01-02: freebsd port maintainer notified 2011-01-07: every linux port notified 2011-01-10: PE version 3.0.6a and 3.2.1a released 2011-01-14: OSE version 3.0.10 and 3.1.4 released 2011-01-16: OSE version 3.2.2 released 11. VENDOR RESPONSE 12. REFERENCES Debian bug: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=608491 Debian security track: http://security-tracker.debian.org/tracker/CVE-2011-0343 upstream patch: http://git.balabit.hu/?p=bazsi/syslog-ng-3.0.git;a=commit;h=17531d911d54 4687fb9c5bd3b130dd5bf7903db0 upstream patch: http://git.balabit.hu/?p=bazsi/syslog-ng-3.1.git;a=commit;h=cbcea8c95c3f 07ed9eaa4d12f124db8f8ca2f74b upstream patch: http://git.balabit.hu/?p=bazsi/syslog-ng-3.2.git;a=commit;h=96af7607873e 126ecee0eb51a5fff46a920c5630 upstream announcement: https://lists.balabit.com/pipermail/syslog-ng-announce/2011-January/0001 01.html upstream announcement: https://lists.balabit.com/pipermail/syslog-ng-announce/2011-January/0001 02.html upstream announcement: https://lists.balabit.com/pipermail/syslog-ng-announce/2011-January/0001 03.html upstream announcement: https://lists.balabit.com/pipermail/syslog-ng-announce/2011-January/0001 04.html upstream announcement: https://lists.balabit.com/pipermail/syslog-ng-announce/2011-January/0001 05.html freebsd port: http://www.freshports.org/commit.php?category=sysutils&port=syslog-ng3&f iles=yes&message_id=201101041550.p04Fov6n028317 (at) repoman.freebsd (dot) org [email concealed] -- SZALAY Attila Support (L3) Team Leader e-mail: attila.szalay (at) balabit (dot) com [email concealed] BalaBit IT Security www.balabit.com H-1115 B&#195;&#161;rtfai str. 54. Budapest This Communication is Confidential. We only send and receive email on the basis of the terms set out at http://www.balabit.com/disclaimer/.