Skip to main content

Rsyslog CVE-2014-3683

MEDIUM
Numeric Errors (CWE-189)
2014-11-02 secalert@redhat.com
Denial Of Service Rsyslog Sysklogd
5.0
CVSS 2.0 · NVD
Share

Severity by source

NVD PRIMARY
5.0 MEDIUM
AV:N/AC:L/Au:N/C:N/I:N/A:P

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:N/AC:L/Au:N/C:N/I:N/A:P
Attack Vector
Network
Attack Complexity
Low
Confidentiality
None
Integrity
None
Availability
P

Lifecycle Timeline

1
CVE Published
Nov 02, 2014 - 00:55 cve.org
MEDIUM 5.0

DescriptionCVE.org

Integer overflow in rsyslog before 7.6.7 and 8.x before 8.4.2 and sysklogd 1.5 and earlier allows remote attackers to cause a denial of service (crash) via a large priority (PRI) value. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-3634.

AnalysisAI

Integer overflow in rsyslog before 7.6.7 and 8.x before 8.4.2 and sysklogd 1.5 and earlier allows remote attackers to cause a denial of service (crash) via a large priority (PRI) value. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.

Technical ContextAI

This vulnerability is classified under CWE-189. Integer overflow in rsyslog before 7.6.7 and 8.x before 8.4.2 and sysklogd 1.5 and earlier allows remote attackers to cause a denial of service (crash) via a large priority (PRI) value. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-3634. Affected products include: Rsyslog, Sysklogd Project Sysklogd. Version information: before 7.6.7.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Rsyslog

View all
CVE-2014-3634 HIGH POC
7.5 Nov 02

rsyslog before 7.6.6 and 8.x before 8.4.1 and sysklogd 1.5 and earlier allows remote attackers to cause a denial of serv
CVE-2017-12588 CRITICAL
9.8 Aug 06

The zmq3 input and output modules in rsyslog before 8.28.0 interpreted description fields as format strings, possibly al
CVE-2019-17042 CRITICAL
9.8 Oct 07

An issue was discovered in Rsyslog v8.1908.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploit
CVE-2019-17041 CRITICAL
9.8 Oct 07

An issue was discovered in Rsyslog v8.1908.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploit
CVE-2019-17040 CRITICAL
9.8 Sep 30

contrib/pmdb2diag/pmdb2diag.c in Rsyslog v8.1908.0 allows out-of-bounds access because the level length is mishandled. R
CVE-2022-24903 HIGH
8.1 May 06

Rsyslog is a rocket-fast system for log processing. Rated high severity (CVSS 8.1), this vulnerability is remotely explo
CVE-2013-4758 MEDIUM
6.8 Oct 04

Double free vulnerability in the writeDataError function in the ElasticSearch plugin (omelasticsearch) in rsyslog before
CVE-2015-3243 MEDIUM
5.5 Jul 25

rsyslog uses weak permissions for generating log files, which allows local users to obtain sensitive information by read

Same weakness CWE-189 – Numeric Errors

View all
CVE-2013-2094 HIGH POC
8.4
CVE-2015-3864 CRITICAL POC
10.0
CVE-2012-1182 CRITICAL POC
10.0
CVE-2015-1538 CRITICAL POC
10.0
CVE-2016-3645 CRITICAL POC
9.8
CVE-2015-3087 CRITICAL POC
10.0
CVE-2015-2470 CRITICAL POC
9.3
CVE-2013-4124 MEDIUM POC
5.0

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Share

CVE-2014-3683 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy