OSVDB ID: 5824

Title: klogd Malformed Kernel Message Format String

Info

Disclosure
Sep 17, 2000

Discovery
Sep 17, 2000

Dates

Exploit
Sep 17, 2000

Solution
Unknown

Description

 Linux kernel klogd contains a flaw that may allow a malicious user to gain access to unauthorized privileges. The issue is triggered when a malicious user passes a buffer containing '%' characters between pairs of '[<' and '>]' delimiters directly to the syslog() function, causing klogd to crash with a segmentation fault. This flaw may lead to a loss of Integrity.

Classification

 Location: Local Access Required, Remote/Network Access Required
Attack Type: Input Manipulation
Impact: Loss of Integrity
Exploit: Exploit Available
Disclosure: OSVDB Verified

Solution

 Currently, there are no known workarounds or upgrades to correct this issue. However, most linux vendors have released a patch to address this vulnerability.

Products

All Vendors

Linux Kernel klogd

 2.0.36

References

Credit
  • Jouko Pynnonen - joukoBrand New Doo Dooiki.fi - Personal Page


Direct URL: http://osvdb.org/36218