CVE-2011-3200 Memory corruption in n/a

Medium 5.0 Published 6 Sep 2011 Updated 6 Aug 2024

Remote attackers can cause a denial of service in rsyslog by sending a legacy syslog message with an excessively long TAG, triggering a stack-based buffer overflow.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2011-3200?

CVE-2011-3200 is a medium-severity memory corruption vulnerability in n/a, published on 6 Sep 2011. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Stack-based buffer overflow in the parseLegacySyslogMsg function in tools/syslogd.c in rsyslogd in rsyslog 4.6.x before 4.6.8 and 5.2.0 through 5.8.4 might allow remote attackers to cause a denial of service (application exit) via a long TAG in a legacy syslog message.

Weakness: CWE-119

Which versions are affected by CVE-2011-3200?

It affects 1 product.

Linux distribution packages (7)

`rsyslog` Red Hat:enterprise_linux:6::server	All versions	`0:4.6.2-3.el6_1.2`
`rsyslog-debuginfo` Red Hat:enterprise_linux:6::server	All versions	`0:4.6.2-3.el6_1.2`
`rsyslog-gnutls` Red Hat:enterprise_linux:6::server	All versions	`0:4.6.2-3.el6_1.2`
`rsyslog-gssapi` Red Hat:enterprise_linux:6::server	All versions	`0:4.6.2-3.el6_1.2`
`rsyslog-mysql` Red Hat:enterprise_linux:6::server	All versions	`0:4.6.2-3.el6_1.2`
`rsyslog-pgsql` Red Hat:enterprise_linux:6::server	All versions	`0:4.6.2-3.el6_1.2`
`rsyslog-relp` Red Hat:enterprise_linux:6::server	All versions	`0:4.6.2-3.el6_1.2`

Products include Rsyslog Rsyslog.

How do I fix CVE-2011-3200?

Upgrade to a fixed version.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2011-3200 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2011-3200 exists.

Public exploit code: 1 Metasploit module.

Sources

Also known as DEBIAN-CVE-2011-3200, GHSA-56wq-xcxw-c4q3, RHSA-2011:1247.