Vulnerabilities > CVE-2006-1624 - Unspecified vulnerability in Linux Kernel 2.6.20.1

047910
CVSS 0.0 - NONE
Attack vector
UNKNOWN
Attack complexity
UNKNOWN
Privileges required
UNKNOWN
Confidentiality impact
UNKNOWN
Integrity impact
UNKNOWN
Availability impact
UNKNOWN
linux
NVD
Published: 2006-04-05
Updated: 2024-11-21

Summary

The default configuration of syslogd in the Linux sysklogd package does not enable the -x (disable name lookups) option, which allows remote attackers to cause a denial of service (traffic amplification) via messages with spoofed source IP addresses.

Vulnerable Configurations

Part Description Count
OS
Linux
1

Statements

  • contributorVincent Danen
    lastmodified2006-07-20
    organizationMandriva
    statementMandriva does not enable the -r option in syslogd per default, which prevents syslogd from listening for remote events. The -x option is also described in /etc/sysconfig/syslog for those who wish to enable the -r option.
  • contributorJoshua Bressers
    lastmodified2006-12-06
    organizationRed Hat
    statementRed Hat does not consider this to be a security issue. Enabling the -r option is not suggested without the -x option which is clearly documented in the /etc/sysconfig/syslog configuration file.

References