-----BEGIN PGP SIGNED MESSAGE----- The program "logsurfer" was designed to monitor any text-based logfiles on systems in realtime. For more informations about logsurfer we refer to http://www.cert.dfn.de/eng/logsurf/home.html 1. Affected software: All logsurfer versions including 1.5a and earlier. 1. Problem: Two vulnerabilities exist In logsurfer version 1.5a and earlier: a) A off-by-one buffer overflow in the heap segment can occur in function context_action() in context.c. Dependent on the configuration and the memory management of the language runtime system this bug can lead to a crash of logsurfer. In detail, only configurations are affected which use the "pipe" action. Although it cannot be ruled out that this vulnerability can be used to execute arbitrary code, we're not aware of any exploits to this. b) A buffer used for the temporary storage of config lines is not properly initialized in function readcfg(). Dependent on the content of this buffer the function readline() incorrectly assumes that this is old data. This data is then used as a config line. 2. Solution: We recommend to upgrade to logsurfer version 1.5b which is available from the URL: ftp://ftp.cert.dfn.de/pub/tools/audit/logsurfer/ In addition, a Patch is available from the URL stated above. It is strongly recommended to prove the authenticity of the logsurfer distribution using pgp and/or md5 checksum: a) pgp logsurfer-1.5b.tar.asc pgp key "Jan Kohlrausch, DFN-CERT <kohlrausch@cert.dfn.de>" is required: KeyID 0xA5DD03D1, Key fingerprint = A2 55 1C 51 0A 30 3E 78 5B 40 DA B7 14 F7 C9 E8 b) Md5 checksum: MD5 (logsurfer-1.5b.tar) = ade77bed7bc3c73fd26039e69c4937f4 credits: Jonathan Heusser, Yonekawa Susumu, Gary L. Hennigan, and Miron Cuperman for reporting the vulnerability and suplying a patch. In addition, we thank Wolfgang Ley for his constructive comments. best regards, DFN-CERT - -- DFN-CERT GmbH | mailto:info@cert.dfn.de Oberstr. 14b | http://www.cert.dfn.de/ D-20144 Hamburg | Phone: +49(40) 808077 555 Germany | FAX: +49(40) 808077 556 -----BEGIN PGP SIGNATURE----- Version: 2.6.2i Comment: Processed by Mailcrypt 3.5.5, an Emacs/PGP interface iQEVAgUBPZ3LF+I9ttyl3QPRAQGz6gf+PkD6rpksdjtGFTxDZH5bH+gbE6f4gCPG xcvlsbj3E8KFg+0fNgwY55KyGXppupgAFXrEI3iwrjsARZYtpGqd77nf0l+rzq4/ Bmeqor3v+iXYE8+rBYnraaTbCbxURwuODEQIuGvKrhjg06JPCKlIrROVc7Q0ep6d XBZfKYpFrZGrClUBBD/aZ5gFif64i/Vf1w1qSHn6NqFHbB3ZVSBOXH/SJge3P7Lv I4tFliXT7XkyYvQO/f5kBf9i7+e8SX9ne74jJY9oOSJcs9HkX7jjyniYfy2VzvzM L1i/22IoRft2BcT9g5UMzYoOv1N7GkT7dxRky1Ty3A0uLK/cD9KofA== =/UcX -----END PGP SIGNATURE-----
