CVE-2018-1000140
published 2018-03-23CVE-2018-1000140: rsyslog librelp version 1.2.14 and earlier contains a Buffer Overflow vulnerability in the checking of x509 certificates from a peer that can result in Remote…
PriorityP261critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
EPSS
9.34%
95.0th percentile
rsyslog librelp version 1.2.14 and earlier contains a Buffer Overflow vulnerability in the checking of x509 certificates from a peer that can result in Remote code execution. This attack appear to be exploitable a remote attacker that can connect to rsyslog and trigger a stack buffer overflow by sending a specially crafted x509 certificate.
Affected
30 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | librelp | < librelp 1.2.15-1 (bookworm) | librelp 1.2.15-1 (bookworm) |
| redhat | enterprise_linux_desktop | — | — |
| redhat | enterprise_linux_desktop | — | — |
| redhat | enterprise_linux_server | — | — |
| redhat | enterprise_linux_server | — | — |
| redhat | enterprise_linux_server_aus | — | — |
| redhat | enterprise_linux_server_aus | — | — |
| redhat | enterprise_linux_server_aus | — | — |
| redhat | enterprise_linux_server_aus | — | — |
| redhat | enterprise_linux_server_aus | — | — |
| redhat | enterprise_linux_server_eus | — | — |
| redhat | enterprise_linux_server_eus | — | — |
| redhat | enterprise_linux_server_eus | — | — |
| redhat | enterprise_linux_server_eus | — | — |
| redhat | enterprise_linux_server_eus | — | — |
| redhat | enterprise_linux_server_tus | — | — |
| redhat | enterprise_linux_server_tus | — | — |
| redhat | enterprise_linux_server_tus | — | — |
| redhat | enterprise_linux_server_tus | — | — |
| redhat | enterprise_linux_server_tus | — | — |
| redhat | enterprise_linux_workstation | — | — |
| redhat | enterprise_linux_workstation | — | — |
Detection & IOCsextracted from sources · hover to see the quote
urlhttps://github.com/rsyslog/librelp/blob/532aa362f0f7a8d037505b0a27a1df452f9bac9e/src/tcp.c#L1205↗
- →The vulnerable function is `relpTcpChkPeerName` in `src/tcp.c` (around line 1205). Monitor or instrument this function for abnormally large X.509 certificate field inputs that could trigger a stack-based buffer overflow. ↗
- →Detect exploitation attempts by monitoring RELP (Reliable Event Logging Protocol) connections carrying oversized or malformed X.509 certificates from remote peers. ↗
- →Alert on librelp versions 1.2.14 and earlier running in environments where RELP services are exposed to untrusted networks, as these are vulnerable to remote code execution via crafted X.509 certificates. ↗
- ·Exploitation requires the attacker to be able to connect to the rsyslog RELP service. Restricting network access to RELP services significantly reduces attack surface. ↗
- ·After patching librelp to version 1.2.15 or later, rsyslog must be restarted for the fix to take effect. ↗
CVSS provenance
nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv9.8CRITICAL
vendor_debian9.8CRITICAL
vendor_redhat9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-m73v-c2p6-943p: rsyslog librelp version 1
ghsa_unreviewed·2022-05-13
CVE-2018-1000140 [CRITICAL] CWE-787 GHSA-m73v-c2p6-943p: rsyslog librelp version 1
rsyslog librelp version 1.2.14 and earlier contains a Buffer Overflow vulnerability in the checking of x509 certificates from a peer that can result in Remote code execution. This attack appear to be exploitable a remote attacker that can connect to rsyslog and trigger a stack buffer overflow by sending a specially crafted x509 certificate.
OSV
CVE-2018-1000140: rsyslog librelp version 1
osv·2018-03-23·CVSS 9.8
CVE-2018-1000140 [CRITICAL] CVE-2018-1000140: rsyslog librelp version 1
rsyslog librelp version 1.2.14 and earlier contains a Buffer Overflow vulnerability in the checking of x509 certificates from a peer that can result in Remote code execution. This attack appear to be exploitable a remote attacker that can connect to rsyslog and trigger a stack buffer overflow by sending a specially crafted x509 certificate.
Ubuntu
librelp vulnerability
vendor_ubuntu·2021-03-15
CVE-2018-1000140 librelp vulnerability
Title: librelp vulnerability
Summary: librelp could be made to run programs as an administrator.
It was discovered that librelp did not properly manage x509 certificates,
leading to a stack-based buffer overflow. A remote attacker could possibly
use this issue to execute arbitrary code.
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
librelp vulnerability
vendor_ubuntu·2018-03-28
CVE-2018-1000140 librelp vulnerability
Title: librelp vulnerability
Summary: librelp could be made to crash or run programs if it received specially
crafted network traffic.
Bas van Schaik and Kevin Backhouse discovered that librelp incorrectly
handled checking certain x509 certificates. A remote attacker able to
connect to rsyslog could possibly use this issue to execute arbitrary code.
Instructions: After a standard system update you need to restart rsyslog to make all the
necessary changes.
Red Hat
librelp: Stack-based buffer overflow in relpTcpChkPeerName function in src/tcp.c
vendor_redhat·2018-03-23·CVSS 9.8
CVE-2018-1000140 [CRITICAL] CWE-121 librelp: Stack-based buffer overflow in relpTcpChkPeerName function in src/tcp.c
librelp: Stack-based buffer overflow in relpTcpChkPeerName function in src/tcp.c
rsyslog librelp version 1.2.14 and earlier contains a Buffer Overflow vulnerability in the checking of x509 certificates from a peer that can result in Remote code execution. This attack appear to be exploitable a remote attacker that can connect to rsyslog and trigger a stack buffer overflow by sending a specially crafted x509 certificate.
A stack-based buffer overflow was found in the way librelp parses X.509 certificates. By connecting or accepting connections from a remote peer, an attacker may use a specially crafted X.509 certificate to exploit this flaw and potentially execute arbitrary code.
Mitigation: Users are strongly advised not to expose their logging RELP services to a public network.
Packag
Debian
CVE-2018-1000140: librelp - rsyslog librelp version 1.2.14 and earlier contains a Buffer Overflow vulnerabil...
vendor_debian·2018·CVSS 9.8
CVE-2018-1000140 [CRITICAL] CVE-2018-1000140: librelp - rsyslog librelp version 1.2.14 and earlier contains a Buffer Overflow vulnerabil...
rsyslog librelp version 1.2.14 and earlier contains a Buffer Overflow vulnerability in the checking of x509 certificates from a peer that can result in Remote code execution. This attack appear to be exploitable a remote attacker that can connect to rsyslog and trigger a stack buffer overflow by sending a specially crafted x509 certificate.
Scope: local
bookworm: resolved (fixed in 1.2.15-1)
bullseye: resolved (fixed in 1.2.15-1)
forky: resolved (fixed in 1.2.15-1)
sid: resolved (fixed in 1.2.15-1)
trixie: resolved (fixed in 1.2.15-1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2018-1000140 librelp: Stack-based buffer overflow in relpTcpChkPeerName function in src/tcp.c
bugzilla·2018-03-23·CVSS 9.8
CVE-2018-1000140 [CRITICAL] CVE-2018-1000140 librelp: Stack-based buffer overflow in relpTcpChkPeerName function in src/tcp.c
CVE-2018-1000140 librelp: Stack-based buffer overflow in relpTcpChkPeerName function in src/tcp.c
librelp version 1.2.14 and earlier contains a Buffer Overflow vulnerability in the checking of x509 certificates from a peer that can result in Remote code execution. This attack appear to be exploitable a remote attacker that can connect to rsyslog and trigger a stack buffer overflow by sending a specially crafted x509 certificate.
Upstream patch:
https://github.com/rsyslog/librelp/commit/2cfe657672636aa5d7d2a14cfcb0a6ab9d1f00cf
References:
https://lgtm.com/rules/1505913226124/
https://github.com/rsyslog/librelp/blob/532aa362f0f7a8d037505b0a27a1df452f9bac9e/src/tcp.c#L1205
Discussion:
Created librelp tracking bugs for this issue:
Affects: fedora-all [bug 1560085]
---
External Refere
Bugzilla
CVE-2018-1000140 librelp: Stack-based buffer overflow in relpTcpChkPeerName function in src/tcp.c [fedora-all]
bugzilla·2018-03-23·CVSS 9.8
CVE-2018-1000140 [CRITICAL] CVE-2018-1000140 librelp: Stack-based buffer overflow in relpTcpChkPeerName function in src/tcp.c [fedora-all]
CVE-2018-1000140 librelp: Stack-based buffer overflow in relpTcpChkPeerName function in src/tcp.c [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue af
http://packetstormsecurity.com/files/172829/librelp-Remote-Code-Execution.htmlhttps://access.redhat.com/errata/RHSA-2018:1223https://access.redhat.com/errata/RHSA-2018:1225https://access.redhat.com/errata/RHSA-2018:1701https://access.redhat.com/errata/RHSA-2018:1702https://access.redhat.com/errata/RHSA-2018:1703https://access.redhat.com/errata/RHSA-2018:1704https://access.redhat.com/errata/RHSA-2018:1707https://github.com/rsyslog/librelp/blob/532aa362f0f7a8d037505b0a27a1df452f9bac9e/src/tcp.c#L1205https://lgtm.com/rules/1505913226124/https://security.gentoo.org/glsa/201804-21https://usn.ubuntu.com/3612-1/https://www.debian.org/security/2018/dsa-4151http://packetstormsecurity.com/files/172829/librelp-Remote-Code-Execution.htmlhttps://access.redhat.com/errata/RHSA-2018:1223https://access.redhat.com/errata/RHSA-2018:1225https://access.redhat.com/errata/RHSA-2018:1701https://access.redhat.com/errata/RHSA-2018:1702https://access.redhat.com/errata/RHSA-2018:1703https://access.redhat.com/errata/RHSA-2018:1704https://access.redhat.com/errata/RHSA-2018:1707https://github.com/rsyslog/librelp/blob/532aa362f0f7a8d037505b0a27a1df452f9bac9e/src/tcp.c#L1205https://lgtm.com/rules/1505913226124/https://security.gentoo.org/glsa/201804-21https://usn.ubuntu.com/3612-1/https://www.debian.org/security/2018/dsa-4151
2018-03-23
Published