CVE-2007-6437 Null dereference in n/a
Remote attackers can crash the syslog-ng server by sending a malformed timestamp, causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2007-6437?
CVE-2007-6437 is a medium-severity vulnerability in n/a, published on 19 Dec 2007. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Balabit syslog-ng 2.0.x before 2.0.6 and 2.1.x before 2.1.8 allows remote attackers to cause a denial of service (crash) via a message with a timestamp that does not contain a trailing space, which triggers a NULL pointer dereference.
Weakness: CWE-20
Which versions are affected by CVE-2007-6437?
It affects 2 products.
Products include Balabit Syslog-Ng Open Source Edition, Balabit Syslog-Ng Premium Edition.
How do I fix CVE-2007-6437?
Upgrade to a fixed version.
Is CVE-2007-6437 being exploited?
There is no known exploitation of CVE-2007-6437 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2007-6437, DSA-1464-1, DTSA-105-1, GHSA-gv7r-26f5-9p85.