Skip to main content

Rsyslog CVE-2013-4758

MEDIUM
Resource Management Errors (CWE-399)
2013-10-04 cve@mitre.org
Denial Of Service Elastic RCE Rsyslog
6.8
CVSS 2.0 · NVD
Share

Severity by source

NVD PRIMARY
6.8 MEDIUM
AV:N/AC:M/Au:N/C:P/I:P/A:P

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:N/AC:M/Au:N/C:P/I:P/A:P
Attack Vector
Network
Attack Complexity
M
Confidentiality
P
Integrity
P
Availability
P

Lifecycle Timeline

1
CVE Published
Oct 04, 2013 - 17:55 cve.org
MEDIUM 6.8

DescriptionCVE.org

Double free vulnerability in the writeDataError function in the ElasticSearch plugin (omelasticsearch) in rsyslog before 7.4.2 and before 7.5.2 devel, when errorfile is set to local logging, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted JSON response.

AnalysisAI

Double free vulnerability in the writeDataError function in the ElasticSearch plugin (omelasticsearch) in rsyslog before 7.4.2 and before 7.5.2 devel, when errorfile is set to local logging, allows. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable.

Technical ContextAI

This vulnerability is classified under CWE-399. Double free vulnerability in the writeDataError function in the ElasticSearch plugin (omelasticsearch) in rsyslog before 7.4.2 and before 7.5.2 devel, when errorfile is set to local logging, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted JSON response. Affected products include: Rsyslog. Version information: before 7.4.2.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Rsyslog

View all
CVE-2014-3634 HIGH POC
7.5 Nov 02

rsyslog before 7.6.6 and 8.x before 8.4.1 and sysklogd 1.5 and earlier allows remote attackers to cause a denial of serv
CVE-2017-12588 CRITICAL
9.8 Aug 06

The zmq3 input and output modules in rsyslog before 8.28.0 interpreted description fields as format strings, possibly al
CVE-2019-17042 CRITICAL
9.8 Oct 07

An issue was discovered in Rsyslog v8.1908.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploit
CVE-2019-17041 CRITICAL
9.8 Oct 07

An issue was discovered in Rsyslog v8.1908.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploit
CVE-2019-17040 CRITICAL
9.8 Sep 30

contrib/pmdb2diag/pmdb2diag.c in Rsyslog v8.1908.0 allows out-of-bounds access because the level length is mishandled. R
CVE-2014-3683 MEDIUM POC
5.0 Nov 02

Integer overflow in rsyslog before 7.6.7 and 8.x before 8.4.2 and sysklogd 1.5 and earlier allows remote attackers to ca
CVE-2022-24903 HIGH
8.1 May 06

Rsyslog is a rocket-fast system for log processing. Rated high severity (CVSS 8.1), this vulnerability is remotely explo
CVE-2015-3243 MEDIUM
5.5 Jul 25

rsyslog uses weak permissions for generating log files, which allows local users to obtain sensitive information by read

Same weakness CWE-399 – Resource Management Errors

View all
CVE-2013-3893 HIGH POC
8.8
CVE-2013-0025 CRITICAL POC
9.3
CVE-2015-0064 CRITICAL POC
9.3
CVE-2015-0065 CRITICAL POC
9.3
CVE-2013-3846 CRITICAL POC
9.3
CVE-2016-5427 HIGH
7.5
CVE-2013-0233 MEDIUM POC
6.8
CVE-2013-1305 HIGH
7.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Share

CVE-2013-4758 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy