[ GLSA 200907-10 ] Syslog-ng: Chroot escape

[GLSA]

Gentoo Linux Security Advisory

Title: Syslog-ng: Chroot escape (GLSA 200907-10)
Severity: low
Exploitable: local
Date: July 12, 2009
Bug(s): #247278
ID: 200907-10

Synopsis

Syslog-ng does not properly initialize its chroot jail allowing for an escape if a separate vulnerability in Syslog-ng is exploited.

Background

Syslog-ng is a flexible and scalable system logger.

Affected Packages

Package: app-admin/syslog-ng
Vulnerable: < 2.1.3
Unaffected: >= 2.0.10 < 2.0.11
Unaffected: >= 2.1.3
Architectures: All supported architectures


Description

Florian Grandel reported that Syslog-ng does not call chdir() before chroot() which leads to an inherited file descriptor to the current working directory.

Impact

A local attacker might exploit a separate vulnerability in Syslog-ng and use this vulnerability to escape the chroot jail.

Workaround

There is no known workaround at this time.

Resolution

All Syslog-ng 2.0 users should upgrade to the latest version: