CVE-2008-5617

Опубликовано: 17 дек. 2008

Источник: nvd

CVSS2: 8.5

EPSS Низкий

Описание

The ACL handling in rsyslog 3.12.1 to 3.20.0, 4.1.0, and 4.1.1 does not follow $AllowedSender directive, which allows remote attackers to bypass intended access restrictions and spoof log messages or create a large number of spurious messages.

Ссылки

http://secunia.com/advisories/32857
Vendor Advisory
http://www.rsyslog.com/Article322.phtml
Patch
Vendor Advisory
http://www.rsyslog.com/Article327.phtml
http://www.rsyslog.com/Topic4.phtml
http://www.securityfocus.com/bid/32630
https://exchange.xforce.ibmcloud.com/vulnerabilities/47080
http://secunia.com/advisories/32857
Vendor Advisory
http://www.rsyslog.com/Article322.phtml
Patch
Vendor Advisory
http://www.rsyslog.com/Article327.phtml
http://www.rsyslog.com/Topic4.phtml
http://www.securityfocus.com/bid/32630
https://exchange.xforce.ibmcloud.com/vulnerabilities/47080

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:rsyslog:rsyslog:3.12.1:*:*:*:*:*:*:*

cpe:2.3:a:rsyslog:rsyslog:3.12.2:*:*:*:*:*:*:*

cpe:2.3:a:rsyslog:rsyslog:3.12.3:*:*:*:*:*:*:*

cpe:2.3:a:rsyslog:rsyslog:3.12.4:*:*:*:*:*:*:*

cpe:2.3:a:rsyslog:rsyslog:3.12.5:*:*:*:*:*:*:*

cpe:2.3:a:rsyslog:rsyslog:3.13.0:*:*:*:*:*:*:*

cpe:2.3:a:rsyslog:rsyslog:3.15.0:*:*:*:*:*:*:*

cpe:2.3:a:rsyslog:rsyslog:3.15.1:beta:*:*:*:*:*:*

cpe:2.3:a:rsyslog:rsyslog:3.17.0:*:*:*:*:*:*:*

cpe:2.3:a:rsyslog:rsyslog:3.17.1:*:*:*:*:*:*:*

cpe:2.3:a:rsyslog:rsyslog:3.17.4:beta:*:*:*:*:*:*

cpe:2.3:a:rsyslog:rsyslog:3.17.5:beta:*:*:*:*:*:*

cpe:2.3:a:rsyslog:rsyslog:3.19.0:*:*:*:*:*:*:*

cpe:2.3:a:rsyslog:rsyslog:3.19.1:*:*:*:*:*:*:*

cpe:2.3:a:rsyslog:rsyslog:3.19.2:*:*:*:*:*:*:*

cpe:2.3:a:rsyslog:rsyslog:3.19.3:*:*:*:*:*:*:*

cpe:2.3:a:rsyslog:rsyslog:3.19.4:*:*:*:*:*:*:*

cpe:2.3:a:rsyslog:rsyslog:3.19.5:*:*:*:*:*:*:*

cpe:2.3:a:rsyslog:rsyslog:3.19.6:*:*:*:*:*:*:*

cpe:2.3:a:rsyslog:rsyslog:3.19.7:*:*:*:*:*:*:*

cpe:2.3:a:rsyslog:rsyslog:3.19.8:*:*:*:*:*:*:*

cpe:2.3:a:rsyslog:rsyslog:3.19.9:*:*:*:*:*:*:*

cpe:2.3:a:rsyslog:rsyslog:3.19.10:*:*:*:*:*:*:*

cpe:2.3:a:rsyslog:rsyslog:3.19.11:*:*:*:*:*:*:*

cpe:2.3:a:rsyslog:rsyslog:3.19.12:*:*:*:*:*:*:*

cpe:2.3:a:rsyslog:rsyslog:3.20.0:*:*:*:*:*:*:*

cpe:2.3:a:rsyslog:rsyslog:4.1.0:*:*:*:*:*:*:*

cpe:2.3:a:rsyslog:rsyslog:4.1.1:*:*:*:*:*:*:*

EPSS

Процентиль: 59%

0.00389

Низкий

8.5 High

CVSS2

Дефекты

CWE-264

Связанные уязвимости

CVE-2008-5617

ubuntu

около 17 лет назад

CVE-2008-5617

debian

около 17 лет назад

The ACL handling in rsyslog 3.12.1 to 3.20.0, 4.1.0, and 4.1.1 does no ...

GHSA-8fh8-56w4-443q

github

больше 3 лет назад

EPSS

Процентиль: 59%

0.00389

Низкий

8.5 High

CVSS2

Дефекты

CWE-264