CVE-2008-5110 Other in n/a
Attackers can escape the chroot jail in syslog-ng if another vulnerability exists, potentially leading to privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2008-5110?
CVE-2008-5110 is a critical vulnerability in n/a, published on 17 Nov 2008. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
syslog-ng does not call chdir when it calls chroot, which might allow attackers to escape the intended jail. NOTE: this is only a vulnerability when a separate vulnerability is present. This flaw affects syslog-ng versions prior to and including 2.0.9.
Which versions are affected by CVE-2008-5110?
It affects 1 product.
Linux distribution packages (1)
syslog-ng openSUSE:Tumbleweed | All versions | 3.33.2-1.2 |
Products include Oneidentity Syslog-Ng.
How do I fix CVE-2008-5110?
Upgrade to a fixed version.
Is CVE-2008-5110 being exploited?
There is no known exploitation of CVE-2008-5110 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as DEBIAN-CVE-2008-5110, GHSA-423j-83rg-3cgc, openSUSE-SU-2024:11418-1.