Ubuntu Security Notice 3612-1 - Bas van Schaik and Kevin Backhouse discovered that librelp incorrectly handled checking certain x509 certificates. A remote attacker able to connect to rsyslog could possibly use this issue to execute arbitrary code.
0cf0854f31f05becfd0afac835a46b76bc9aefd388c74042f2deed97e2e2c5e7
==========================================================================
Ubuntu Security Notice USN-3612-1
March 28, 2018
librelp vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 14.04 LTS
Summary:
librelp could be made to crash or run programs if it received specially
crafted network traffic.
Software Description:
- librelp: Reliable Event Logging Protocol (RELP) library
Details:
Bas van Schaik and Kevin Backhouse discovered that librelp incorrectly
handled checking certain x509 certificates. A remote attacker able to
connect to rsyslog could possibly use this issue to execute arbitrary code.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 14.04 LTS:
librelp0 1.2.2-2ubuntu1.1
After a standard system update you need to restart rsyslog to make all the
necessary changes.
References:
https://usn.ubuntu.com/usn/usn-3612-1
CVE-2018-1000140
Package Information:
https://launchpad.net/ubuntu/+source/librelp/1.2.2-2ubuntu1.1