Vigil@nce: syslog-ng, escaping the chroot
November 2008 by Vigil@nce
An attacker who found a vulnerability in syslog-ng can access to files located outside the chroot jail.
Consequences: data reading, data creation/edition
Provenance: user shell
Means of attack: no proof of concept, no attack
Ability of attacker: expert (4/4)
Confidence: confirmed by the editor (5/5)
Diffusion of the vulnerable configuration: low (1/3)
Creation date: 18/11/2008
Unix - plateform
The syslog-ng logging daemon can be configured with a chroot jail. A potential attacker is thus restricted to files located inside the root of the jail.
However, this jail is not correctly initialized: the current directory is not changed before creating the jail.
An attacker inside the jail can therefore access to files located in the current directory, when the daemon is started (for example /etc/init.d).
Identifiers: 505791, CVE-2008-5110, VIGILANCE-VUL-8253