Contactez-nous Suivez-nous sur Twitter En francais English Language

De la Théorie à la pratique

Freely subscribe to our NEWSLETTER

Newsletter FR

Newsletter EN



Vigil@nce: syslog-ng, escaping the chroot

November 2008 by Vigil@nce


An attacker who found a vulnerability in syslog-ng can access to files located outside the chroot jail.

Gravity: 1/4

Consequences: data reading, data creation/edition

Provenance: user shell

Means of attack: no proof of concept, no attack

Ability of attacker: expert (4/4)

Confidence: confirmed by the editor (5/5)

Diffusion of the vulnerable configuration: low (1/3)

Creation date: 18/11/2008


- Unix - plateform


The syslog-ng logging daemon can be configured with a chroot jail. A potential attacker is thus restricted to files located inside the root of the jail.

However, this jail is not correctly initialized: the current directory is not changed before creating the jail.

An attacker inside the jail can therefore access to files located in the current directory, when the daemon is started (for example /etc/init.d).


Identifiers: 505791, CVE-2008-5110, VIGILANCE-VUL-8253

See previous articles


See next articles