Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2018.0855 librelp security update 27 March 2018 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: librelp Publisher: Debian Operating System: Debian GNU/Linux 8 Debian GNU/Linux 9 UNIX variants (UNIX, Linux, OSX) Impact/Access: Execute Arbitrary Code/Commands -- Remote/Unauthenticated Denial of Service -- Remote/Unauthenticated Resolution: Patch/Upgrade CVE Names: CVE-2018-1000140 Original Bulletin: http://www.debian.org/security/2018/dsa-4151 Comment: This advisory references vulnerabilities in products which run on platforms other than Debian. It is recommended that administrators running librelp check for an updated version of the software for their operating system. - --------------------------BEGIN INCLUDED TEXT-------------------- - -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - - ------------------------------------------------------------------------- Debian Security Advisory DSA-4151-1 security@debian.org https://www.debian.org/security/ Salvatore Bonaccorso March 26, 2018 https://www.debian.org/security/faq - - ------------------------------------------------------------------------- Package : librelp CVE ID : CVE-2018-1000140 Bas van Schaik and Kevin Backhouse discovered a stack-based buffer overflow vulnerability in librelp, a library providing reliable event logging over the network, triggered while checking x509 certificates from a peer. A remote attacker able to connect to rsyslog can take advantage of this flaw for remote code execution by sending a specially crafted x509 certificate. Details can be found in the upstream advisory: http://www.rsyslog.com/cve-2018-1000140/ For the oldstable distribution (jessie), this problem has been fixed in version 1.2.7-2+deb8u1. For the stable distribution (stretch), this problem has been fixed in version 1.2.12-1+deb9u1. We recommend that you upgrade your librelp packages. For the detailed security status of librelp please refer to its security tracker page at: https://security-tracker.debian.org/tracker/librelp Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org - -----BEGIN PGP SIGNATURE----- iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAlq5V7pfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2 NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND z0RJyg//fjmV4pPHVxtmPabtneJIPj0RCMREfcx4qtFqjpP8n9X/KRQmq3gmv8C8 NtLfysFkTLcoFqaoI/ayeTog523/uuTH6w6tRFnNakx4BdRwsj3WXzldU6XsYQUa P9iu4oV6wstEU2p1K1IG1K/id+TEBmaITeVoxf4arYCDzcGySpZgxOau30u9gVi8 Wx1QBF7ajQrtwX3WnLGfjQjU6QGD4sGMN3S37Wq3adj2t2ocT8bs8kI6460ntaaD /y1TlAlZzrssvXczHzpV7boQFcjEXX2x8C1YLgqkFK59W5LDFemdDpXMedoyOtsM uY0vRHu6AqV9m/VZPW8ETDGLCusGnhUr8O4UgMngNpt0hMi0L6Iz1je6I6evfKiL yDSDWli4EwmhdyW4ZrYe+vxdEqm2MB6PzjZr+sn8kLChVk5Eb2TuAv/hNMGP0t9A snxJISBLnfCrDVoexb7og0b/MCngpUAmZBU4M5pS5XNC+866q1ZzYyrnYBA+vDW+ kywomUwb1w6gIBQQbfYf1VCfA6yvZtemDeYb+xs922z48P0F5BAlYqkelMc9FLnn JETFPzqLpSATuPVLivxiki8WyPBBCQlbiZ30c0LwtZmtx+xVtrKgj8YK66sbrBoq s815gPmJ7d6NT65SxYVoXdNtIynFKTmAU/xSeEfIUtWcrs6SSfc= =Gprz - -----END PGP SIGNATURE----- - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: https://www.auscert.org.au/bulletins/ =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBWrmE94x+lLeg9Ub1AQj1Mg//RBd6iHnyW70O6pRs5JcpAvS3ZN1br67F Oph7KNNIc6EimdlcpjHwQfV/bNKKnV7pVkgphzh4dUhrPWcd4C8vaJSnn7xPWdqE q3BtAOrxG63fppQc2jhttsiEk4zE+GSnfqP7jqVg4WhyVcKFdCfwzvFwh5nY8o6V lVcbcexDqjO1VMxuvum/I7h8bkaU2Soyc3WsHLrACTe965qB2rDdkpV4EXjvYKrb kN/UdOd7hhbEHVAvErI9RZWSJ4GpdjK27VX1e/cA+58znR38uIjM1Zaj90/zgIl0 GwAEmu8OXOVKoCh0KWgYiTeji8S66qfS2xsH/MoNtZJKPdvPwFXNvUJJMY00bD6n +s0frsoOCqGxypJfzQ69jRJgAXHojSYW6uTXIOBx75mipqc4efGdF9agqEbFGUER FT8RYRhNMD8iRrj0VHq9VgMLR6ehXWdV1tBR31lu4ERQ8eg/gzbI4QBFoDurdLMg 15ofryNrMrKPNJ2D9Yst6I5+R2Urfo0YGjVzHj+sWbgfQ5xCWOMCqwvhQNlzlFgN v1bPVdVgayZSUAAkAr0Jxu+OUOe4Z8tFNpf7eLoqPDVMNjxVjtSXkG3zqj4M3ciF 4VdFy2jgENgD9239eTPjVg+WAFp1j80P0cxhQHtVoeZ6bLVA8mlAFrpKG35ve2R8 eSkaDelKXbk= =R6oZ -----END PGP SIGNATURE-----