Debian Bug report logs - #246535
sysklogd: Can be crashed by maliscious user

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: "J.H.M. Dassen (Ray)" <fsmla@xinara.org>

To: submit@bugs.debian.org

Subject: sysklogd: Can be crashed by maliscious user

Date: Thu, 29 Apr 2004 14:37:31 +0200

[Message part 1 (text/plain, inline)]

Package: sysklogd
Version: 1.4.1-14
Severity: grave
Justification: causes data loss (of syslog messages)
Tags: security woody sarge sid upstream patch

http://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2004:038 :
	Steve Grubb discovered a bug in sysklogd where it allocates an
	insufficient amount of memory which causes sysklogd to write
	to unallocated memory. This could allow for a malicious user to
	crash sysklogd.

I'm attaching sysklogd-1.4.1-owl-syslogd-crunch_list.diff.bz2 as
extracted from sysklogd-1.4.1-5.1.100mdk.src.rpm.

-- System Information:
Debian Release: testing/unstable
  APT prefers unstable
  APT policy: (900, 'unstable'), (900, 'testing')
Architecture: i386 (i686)
Kernel: Linux 2.4.27-pre1
Locale: LANG=C, LC_CTYPE=en_US.ISO8859-1

Versions of packages sysklogd depends on:
ii  klogd [linux-kernel-log-dae 1.4.1-14     Kernel Logging Daemon
ii  libc6                       2.3.2.ds1-12 GNU C Library: Shared libraries an

-- no debconf information

[sysklogd-1.4.1-owl-syslogd-crunch_list.diff.bz2 (application/octet-stream, attachment)]

Message #10 received at 246535-done@bugs.debian.org (full text, mbox, reply):

From: Martin Schulze <joey@infodrom.org>

To: 246535-done@bugs.debian.org

Subject: non-issue

Date: Thu, 29 Apr 2004 20:05:34 +0200

I'm sorry but this bug cannot be triggered by a user, so the
description Mandrage/Steve Grubb gave is bogus.  I'm open for
discussions on infodrom-sysklogd@lists.infodrom.org.  This
issue is also documented here:
http://www.infodrom.org/projects/sysklogd/security.php3

Regards,

	Joey

-- 
GNU GPL: "The source will be with you... always."

Message #15 received at 246535@bugs.debian.org (full text, mbox, reply):

From: "J.H.M. Dassen (Ray)" <fsmla@xinara.org>

To: 246535@bugs.debian.org

Subject: Re: Bug#246535 acknowledged by developer (non-issue)

Date: Thu, 29 Apr 2004 23:05:37 +0200

On Thu, Apr 29, 2004 at 11:18:13 -0700, Debian Bug Tracking System wrote:
> I'm sorry but this bug cannot be triggered by a user, so the
> description Mandrage/Steve Grubb gave is bogus.

OK. For reference, it looks like the issue was originally filed as
	http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=120453

Regards,
Ray
-- 
"When you are finished spreading joy on Christmas Eve, come and kick back
with me and Erwin for a while. [...] We'll provide the cocoa and cookies,
and we'll even teach you how to play Quake."
	From the Dust Puppy's letter to Santa Claus.

Send a report that this bug log contains spam.