Adiscon

The Logging Experts

Potential DoS in Interactive Syslog Server

Potential DoS in Interactive Syslog Server

Grossrinderfeld, 2003-09-15 (Updated 2003-10-21)

A potential denial of service (DoS) condition has been identified in Interactive Syslog Server. Oversized messages sent to the Interactive Syslog Server may yield to high CPU utilization of Interactive Syslog Server. Depending on the operating system it is run on, this can also yield to a denial of service condition to the underlaying operating system (Adiscon was not able to reproduce an actual DoS on the operating system itself, but the security researcher discovering this bug said he could do so).

Please note that this vulnerability affects the interactive syslog server, only. Adiscon recommends using interactive server only for real-time message reception and device debugging. Any production monitoring should be done via the WinSyslog or MonitorWare Agent service. The service is not vulnerable to this issue. However, Adiscon has begun a new code audit in respect to buffer sizes. Should any issue with the services be discovered, we will post a new advisory.

As a side note, please keep in mind that interactive processes can never be used for any reliable logging. As such, we strongly recommend against using the Interactive server for any serious and continous logging needs. It is not designed for this, it is designed as an interactive troubleshooting tool. Running a log server interactively will most probably expose you to many more security threads – from simply missing log data because the interactive session was somehow terminated to security weaknesses stemming back to the fact that an interactive logon session was established. Please use WinSyslog securely: if you do serious logging, use the service for this. It is designed for it. The interactive syslog server should not be present in a real-life, serious logging infrastructure (use it to setup your logging environment, test anything and the remove remove it).

Products & Product Versions Affected

All Versions of WinSyslog and MonitorWare Agent downloaded prior to 2003-09-15. As of 2003-09-16, the download sets already contain the fix. Any customer who downloaded the product before that date is advised to download the fix. The fixed version is identified as 4.2.36 in help/about. WinSyslog 5.0 final release includes the fixed version, so there is no need to apply a fix if you use that version.

Solution

Affected customers should download the hotfixes mentioned below and copy the ZIP file contents to the product installation directory. Alternatively, they can download the full package again and re-install it.

Again, we recommend against using Interactive syslog server for serious logging purposes – it was not designed for this. If you use the products as recommended, you will not run Interactive Server at all and willnot be vulnerable.

Credits

Adiscon whishes to thank Noam Rathaus of Beyond Security Ltd. (http://www.securiteam.com) for reporting this issue and working with us to resolve it.

Reporting Security Issues

Adiscon believes in the value of working with security researchers. Any security issue should please be reported to support@adiscon.com and it will receive immediate attention.

Receiving Advisories via EMail

Adiscon also provides product announcement mailing lists. These are of low-volume and strictly technical. They will carry notifications about new product versions, bug fixes and such. They will NOT be abused for marketing. GNU Mailman is used for these mailing lists, so unsubscribing is always easy. Advisories are also posted to our product announcement list. You can subscribe below:

Scroll to top