[ MDVSA-2011:134 ] rsyslog

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Mandriva Linux Security Advisory MDVSA-2011:134
http://www.mandriva.com/security/

Package : rsyslog
Date : September 9, 2011
Affected: 2010.1

Problem Description:

A vulnerability was discovered and corrected in rsyslog:

Stack-based buffer overflow in the parseLegacySyslogMsg function
in tools/syslogd.c in rsyslogd in rsyslog 4.6.x before 4.6.8 and
5.2.0 through 5.8.4 might allow remote attackers to cause a denial of
service (application exit) via a long TAG in a legacy syslog message
(CVE-2011-3200).

The updated packages have been patched to correct this issue.

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3200

Updated Packages:

Mandriva Linux 2010.1:
4ff095f834c62767fab62e01bf4bf5ad 2010.1/i586/rsyslog-4.6.2-3.1mdv2010.2.i586.rpm
9b52eaf525164ecb9d6ad47ce50c4693 2010.1/i586/rsyslog-dbi-4.6.2-3.1mdv2010.2.i586.rpm
6df2f99ca9b22975b26907a490949d50 2010.1/i586/rsyslog-docs-4.6.2-3.1mdv2010.2.i586.rpm
72cd6ec3a85e2d55191a89b80c9c0308 2010.1/i586/rsyslog-gssapi-4.6.2-3.1mdv2010.2.i586.rpm
e112f2071a173c63148ddbf8bb1229f8 2010.1/i586/rsyslog-mysql-4.6.2-3.1mdv2010.2.i586.rpm
4e731bae927bf45bda00907e778cd2e0 2010.1/i586/rsyslog-pgsql-4.6.2-3.1mdv2010.2.i586.rpm
2b023ce607f21357e4b34e6940003142 2010.1/i586/rsyslog-relp-4.6.2-3.1mdv2010.2.i586.rpm
2913ebbb44992bd37a19ab039ce19e67 2010.1/i586/rsyslog-snmp-4.6.2-3.1mdv2010.2.i586.rpm
026553a0aa0e482642d06fac47f9a5a9 2010.1/SRPMS/rsyslog-4.6.2-3.1mdv2010.2.src.rpm

Mandriva Linux 2010.1/X86_64:
940bc1c8d634006998232a016fc482f7 2010.1/x86_64/rsyslog-4.6.2-3.1mdv2010.2.x86_64.rpm
5eac7191b9c168efc686fa7185169080 2010.1/x86_64/rsyslog-dbi-4.6.2-3.1mdv2010.2.x86_64.rpm
368a913c4ea4d81f23492af0eb14119b 2010.1/x86_64/rsyslog-docs-4.6.2-3.1mdv2010.2.x86_64.rpm
0d39cec1ff34fe2fdf9d82ebd7593675 2010.1/x86_64/rsyslog-gssapi-4.6.2-3.1mdv2010.2.x86_64.rpm
70a845d2c36b20f41474a538ffb0b33b 2010.1/x86_64/rsyslog-mysql-4.6.2-3.1mdv2010.2.x86_64.rpm
5601b976ab8078a0ec5a91fdbb25a0ca 2010.1/x86_64/rsyslog-pgsql-4.6.2-3.1mdv2010.2.x86_64.rpm
e82fea64cdb6aeb7eebee19d77b18b80 2010.1/x86_64/rsyslog-relp-4.6.2-3.1mdv2010.2.x86_64.rpm
a293c49c09a306b47d663a0691b20c59 2010.1/x86_64/rsyslog-snmp-4.6.2-3.1mdv2010.2.x86_64.rpm
026553a0aa0e482642d06fac47f9a5a9 2010.1/SRPMS/rsyslog-4.6.2-3.1mdv2010.2.src.rpm

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/security/advisories

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFOab/nmqjQ0CJFipgRAnyMAKCjaZXOxExzh+ivlKy76ulwb9p0hwCgqtZj
flYzZ7xw8wYEA+fRcWxGYv4=
=tyvU
-----END PGP SIGNATURE-----