Linux Today: Linux News On Internet Time.

More on LinuxToday

EnGarde Secure Linux Advisory: syslog-ng

Oct 17, 2002, 15:52 (0 Talkback[s])

| EnGarde Secure Linux Security Advisory                October 16, 2002 |
|                          ESA-20021016-025 |
|                                                                        |
| Package: syslog-ng                                                     |
| Summary: buffer overflow in macro handling code.                       |

  EnGarde Secure Linux is a secure distribution of Linux that features
  improved access control, host and network intrusion detection, Web
  based secure remote management, complete e-commerce using AllCommerce,
  and integrated open source security tools.

- --------
  There is a buffer overflow vulnerability in the syslog-ng's macro
  handling code.  For more information on this vulnerability, please refer
  to the following advisory:

  PLEASE NOTE: Due to a packaging error in our 1.0.1 and 1.1 packages,
  the following log files will be truncated upon installing this update:


  It is therefore highly recommended to save a backup copy of these logs
  before you upgrade:

    # mkdir /var/log/.bak
    # cp -af /var/log/{messages,mail.log,boot.log,login.log,auth.log} \

    # <install the update as outlined below>

    # mv -f /var/log/.bak/{messages,mail.log,boot.log,login.log,auth.log} \
    # rmdir /var/log/.bak

  Only users of EnGarde Secure Community Edition and EnGarde Secure
  Professional 1.1 need to apply this workaround.

  The Common Vulnerabilities and Exposures project ( has
  assigned the name CAN-2002-1200 to this issue.

- --------
  Users of the EnGarde Professional edition can use the Guardian Digital
  Secure Network to update their systems automatically.

  EnGarde Community users should upgrade to the most recent version
  as outlined in this advisory.  Updates may be obtained from:

  Before upgrading the package, the machine must either:

    a) be booted into a "standard" kernel; or
    b) have LIDS disabled.

  To disable LIDS, execute the command:

    # /sbin/lidsadm -S -- -LIDS_GLOBAL

  To install the updated package, execute the command:

    # rpm -Uvh files

  You must now update the LIDS configuration by executing the command:

    # /usr/sbin/

  To re-enable LIDS (if it was disabled), execute the command:

    # /sbin/lidsadm -S -- +LIDS_GLOBAL

  To verify the signatures of the updated packages, execute the command:

    # rpm -Kv files

- ----------------
  These updated packages are for EnGarde Secure Linux Community

  Source Packages:

      MD5 Sum: 9867255a2d25858872d1c9de05028a8e

  Binary Packages:

      MD5 Sum: ae0c785a072f4545f6c0abfee9760090

      MD5 Sum: 4ec459e0b58e99ba043a29c977d18293

- ----------
  Guardian Digital's public key:

  syslog-ng's Official Web Site:

  Security Contact:
  EnGarde Advisories:

- --------------------------------------------------------------------------
$Id: ESA-20021016-025-syslog-ng,v 1.4 2002/10/17 12:27:32 rwm Exp $
- --------------------------------------------------------------------------
Author: Ryan W. Maple <> 
Copyright 2002, Guardian Digital, Inc.