[ GLSA 200907-10 ] Syslog-ng: Chroot escape

[GLSA]

Gentoo Linux Security Advisory

Title: Syslog-ng: Chroot escape (GLSA 200907-10)
Severity: low
Exploitable: local
Date: July 12, 2009
Bug(s): #247278
ID: 200907-10

Synopsis


Syslog-ng does not properly initialize its chroot jail allowing for an
escape if a separate vulnerability in Syslog-ng is exploited.


Background


Syslog-ng is a flexible and scalable system logger.


Affected Packages

Package: app-admin/syslog-ng
Vulnerable: < 2.1.3
Unaffected: >= 2.0.10 < 2.0.11
Unaffected: >= 2.1.3
Architectures: All supported architectures


Description


Florian Grandel reported that Syslog-ng does not call chdir() before
chroot() which leads to an inherited file descriptor to the current
working directory.


Impact


A local attacker might exploit a separate vulnerability in Syslog-ng
and use this vulnerability to escape the chroot jail.


Workaround


There is no known workaround at this time.


Resolution


All Syslog-ng 2.0 users should upgrade to the latest version: