Test ID:	1.3.6.1.4.1.25623.1.0.71454
Category:	Mandrake Local Security Checks
Title:	Mandriva Security Advisory MDVSA-2012:100 (rsyslog)
Summary:	NOSUMMARY
Description:	Description: The remote host is missing an update to rsyslog announced via advisory MDVSA-2012:100. A vulnerability has been discovered and corrected in rsyslog: An integer signedness error, leading to heap based buffer overflow was found in the way the imfile module of rsyslog, an enhanced system logging and kernel message trapping daemon, processed text files larger than 64 KB. When the imfile rsyslog module was enabled, a local attacker could use this flaw to cause denial of service (rsyslogd daemon hang) via specially-crafted message, to be logged (CVE-2011-4623). The updated packages have been patched to correct this issue. Affected: 2010.1 Solution: To upgrade automatically use MandrakeUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. http://www.securityspace.com/smysecure/catid.html?in=MDVSA-2012:100 Risk factor : High
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2011-4623 1026556 http://www.securitytracker.com/id?1026556 45848 http://secunia.com/advisories/45848 47698 http://secunia.com/advisories/47698 51171 http://www.securityfocus.com/bid/51171 USN-1338-1 http://www.ubuntu.com/usn/USN-1338-1 [oss-security] 20111222 Re: CVE Request -- rsyslog -- DoS due integer signedness error while extending rsyslog counted string buffer http://www.openwall.com/lists/oss-security/2011/12/22/2 http://bugzilla.adiscon.com/show_bug.cgi?id=221 http://git.adiscon.com/?p=rsyslog.git%3Ba=commit%3Bh=6bad782f154b7f838c7371bf99c13f6dc4ec4101 http://rsyslog.com/changelog-for-4-6-6-v4-stable/ http://rsyslog.com/changelog-for-5-7-4-v5-beta/ http://rsyslog.com/changelog-for-6-1-4-devel/ https://bugzilla.redhat.com/show_bug.cgi?id=769822
Copyright	Copyright (c) 2012 E-Soft Inc. http://www.securityspace.com

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.