Vigil@nce: syslog-ng, escaping the chroot
November 2008 by Vigil@nce
SYNTHESIS
An attacker who found a vulnerability in syslog-ng can access to
files located outside the chroot jail.
Gravity: 1/4
Consequences: data reading, data creation/edition
Provenance: user shell
Means of attack: no proof of concept, no attack
Ability of attacker: expert (4/4)
Confidence: confirmed by the editor (5/5)
Diffusion of the vulnerable configuration: low (1/3)
Creation date: 18/11/2008
IMPACTED PRODUCTS
– Unix - plateform
DESCRIPTION
The syslog-ng logging daemon can be configured with a chroot jail.
A potential attacker is thus restricted to files located inside
the root of the jail.
However, this jail is not correctly initialized: the current
directory is not changed before creating the jail.
An attacker inside the jail can therefore access to files located
in the current directory, when the daemon is started (for example
/etc/init.d).
CHARACTERISTICS
Identifiers: 505791, CVE-2008-5110, VIGILANCE-VUL-8253