—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA1

Liebe Kolleginnen und Kollegen,

soeben erreichte uns nachfolgendes Fedora Security Advisory. Wir geben
diese Informationen unveraendert an Sie weiter.

CVE-2011-1951 – Schwachstelle in syslog-ng

Die Art wie syslog-ng einige “Log-Pattern” mit dem PCRE-Back-End
verarbeitet, falls die ‘global’-Option benutzt wird, fuehrt zu einem
sehr hohen Speicherverbrauch. Einem entfernten Angreifer ist es damit
moeglich, einen Denial of Service-Angriff durchzufuehren, indem er
speziell praeparierte Muster verwendet.

Betroffen sind die folgenden Software Pakete und Plattformen:

Paket syslog-ng

Fedora 14

Vom Hersteller werden ueberarbeitete Pakete zur Verfuegung gestellt.

(c) der deutschen Zusammenfassung bei DFN-CERT Services GmbH; die
Verbreitung, auch auszugsweise, ist nur unter Hinweis auf den Urheber,
DFN-CERT Services GmbH, und nur zu nicht kommerziellen Zwecken
gestattet.

Mit freundlichen Gruessen,
Timo Schulz

– —
Timo Schulz, M.Sc. (Incident Response Team)

DFN-CERT Services GmbH, https://www.dfn-cert.de, Phone +49 40 808077-590
Sitz / Register: Hamburg, AG Hamburg, HRB 88805, Ust-IdNr.: DE 232129737
Sachsenstrasse 5, 20097 Hamburg/Germany, CEO: Dr. Klaus-Peter Kossakowski

Automatische Warnmeldungen: https://www.cert.dfn.de/autowarn

– ——————————————————————————–
Fedora Update Notification
FEDORA-2011-8405
2011-06-21 16:09:02
– ——————————————————————————–

Name : syslog-ng
Product : Fedora 14
Version : 3.1.4
Release : 4.fc14
URL : http://www.balabit.com/products/syslog_ng/
Summary : Next-generation syslog server
Description :
syslog-ng, as the name shows, is a syslogd replacement, but with new
functionality for the new generation. The original syslogd allows
messages only to be sorted based on priority/facility pairs; syslog-ng
adds the possibility to filter based on message contents using regular
expressions. The new configuration scheme is intuitive and powerful.
Forwarding logs over TCP and remembering all forwarding hops makes it
ideal for firewalled environments.

– ——————————————————————————–
Update Information:

Patch for CVE-2011-1951
– ——————————————————————————–
ChangeLog:

* Fri Jun 17 2011 Jose Pedro Oliveira – 3.1.4-4
– – Patch for CVE-2011-1951: syslog-ng-3.1.4-pcre-dos.patch (#709088)
– – Enabled the test suite
* Mon May 9 2011 Jose Pedro Oliveira – 3.1.4-3
– – Bumped the eventlog version to match the latest upstream version (0.2.12)
– – Overrided the default _localstatedir value (configure –localstatedir)
(value hardcoded in update-patterndb)
– – Manually created the patterndb.d configuration directory (update-patterndb)
(see also https://bugzilla.balabit.com/show_bug.cgi?id=119 comments >= 4)
– – Minor modifications of the %post, %preun and %postun scripts
– – Corrected a couple of macro references in changelog entries (rpmlint)
– – Expanded tabs to spaces (also added a vim modeline)
* Mon Apr 25 2011 Jose Pedro Oliveira – 3.1.4-2
– – cleans the sysconfig and logrotate file mess (#651823 comments 17, 20 and 21)
– – add support for vim versions 72 and 73; drop support for versions 6.2 and 6.3
– – clean the spoofsource conditional logical: libnet resides in /lib{,64}
since 2009
* Wed Apr 13 2011 Jose Pedro Oliveira – 3.1.4-1
– – update for syslog-ng 3.1.4
– – updated the source URL
– – versioned some of the build requirements
– – dropped the libnet patch (syslog-ng-2.1.4-libnet.patch)
– – dropped support for EPEL-4 and EPEL-5 (syslog-ng 3.x requires pcre >= 7.3)
– – new file: update-patterndb
– ——————————————————————————–
References:

[ 1 ] Bug #709088 – CVE-2011-1951 syslog-ng: DoS (excessive memory use) by processing certain pcre patterns
https://bugzilla.redhat.com/show_bug.cgi?id=709088
– ——————————————————————————–

This update can be installed with the “yum” update program. Use
su -c ‘yum update syslog-ng’ at the command line.
For more information, refer to “Managing Software with yum”,
available at http://docs.fedoraproject.org/yum/.

All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
– ——————————————————————————–

—–BEGIN PGP SIGNATURE—–
Version: GnuPG v2.0.16 (GNU/Linux)

iQEcBAEBAgAGBQJODDvqAAoJEJtyb8U7iGZBBbIH/32TM/MUXlRTryxmVmlshIqY
DCRf4ZAGKD70NZ9im2Q3mM0c38kGlIgPBtJeiYLONJhJtLKTUYTV2RTa5Lvp0eyZ
H6qsSB9MoPvsQQmQADNcSq6KEgFHoxL2FwRmSlAd0sARDLb57vcvpuvvY+jg94wZ
31VpDrAiDnYJeum28YGZhQgxzIXdRXwIvtQ3y0iMZHKkTDJ/LUnhknGpOsS4N0G2
OAp1tvshjLvZFrCgbVCLRcqhy/xdAfYcmhtpwq/lI8rMruNKWSkat9oklB/6RnZs
XDTzCJLoHZvvhBiM0bpyAsv37ATpE6K3lSwBhXY1RFmBV5MThqmwHyR14wXAqsA=
=ORsD
—–END PGP SIGNATURE—–