Double Free Vulnerability in ElasticSearch Plugin for rsyslog
CVE-2013-4758

Currently unrated

Key Information:

Vendor

Rsyslog

Status
Rsyslog
Vendor
CVE Published:
4 October 2013

What is CVE-2013-4758?

A double free vulnerability exists in the writeDataError function of the ElasticSearch plugin for rsyslog. This occurs when the errorfile is configured to use local logging, allowing remote attackers to craft malicious JSON responses that may lead to a crash of the rsyslog service. Additionally, this vulnerability poses a potential risk for remote code execution, thereby compromising the security of the system.

References

http://www.openwall.com/lists/oss-security/2013/07/05/2
mailing-listx_refsource_MLIST
http://www.rsyslog.com/rsyslog-7-5-2-v7-devel-released/
x_refsource_CONFIRM
http://www.rsyslog.com/rsyslog-7-4-2-v7-stable-released/
x_refsource_CONFIRM

Timeline

  • Vulnerability Reserved

  • Vulnerability published

.