- syslog-ng-announce - lists.balabit.hu

New version of The syslog-ng Administrator Guide has been released
by documentation 21 Dec '07

21 Dec '07

------------------------------------------------------------------------------ DOCUMENT : The syslog-ng Administrator Guide VERSION : 1.0.14 SUMMARY : New release DATE : Dec 21, 2007 ------------------------------------------------------------------------------ DESCRIPTION: An updated version of The syslog-ng Administrator Guide is available for download. DOWNLOAD: * BalaBit Documentation Page http://www.balabit.com/support/documentation/ * Direct link to the PDF version: http://www.balabit.com/dl/guides/syslog-ng-v2.0-guide-admin-en.pdf * HTML version: http://www.balabit.com/dl/html/syslog-ng-admin-guide_en.html/index.html

1 0

ZSA-2007-029: syslog-ng Denial of Service
by Balazs Scheidler 17 Dec '07

17 Dec '07

-------- Z o r p S e c u r i t y A d v i s o r y ( Z S A ) ------------ PACKAGE : syslog-ng, syslog-ng-premium-edition AFFECTED VERSION : <= 2.0.6, 2.1.8 FIXED : 2.0.6, 2.1.8 SUMMARY : Denial of Service TYPE : remote AFFECTED : all platforms ZSA-ID : ZSA-2007-029 DATE : Dec 14, 2007 ----------------------------------------------------------------------------- DESCRIPTION: Oriol Carreras has discovered a security vulnerability in syslog-ng, the multi-platform syslog-replacement application developed by BalaBit IT Security. BACKGROUND: Earlier versions of syslog-ng Open Source Edition and syslog-ng Premium Edition were vulnerable to a possible Denial of Service. The latest release (2.0.6 for syslog-ng, 2.1.8 for syslog-ng Premium Edition) fixes a segmentation fault which occurred when the timestamp of the incoming messages did not end with a space character (NULL pointer dereference). This is an easy Denial of Service possibility. Apart from the Denial of Service, no further exploits are known to be possible. FURTHER INFORMATION For further information on syslog-ng, visit http://www.balabit.com/network-security/syslog-ng/ or download the documentation of syslog-ng from http://www.balabit.com/support/documentation/ SOLUTION: We recommend that you update the affected packages immediately, or apply the patch referenced below: http://git.balabit.hu/?p=bazsi/syslog-ng-2.0.git;a=commitdiff;h=3126ebad217… DOWNLOAD: If you are a syslog-ng Open Source Edition user, download the source of the latest release from: http://www.balabit.com/downloads/files/syslog-ng/sources/2.0/src/ If you are a syslog-ng Premium Edition user, or have binary subscription for syslog-ng Open Source Edition, download the latest binaries from: http://www.balabit.com/downloads/files/syslog-ng/binaries/premium-edition/ OR, if you have a platform that is supported by apt-get, use the following apt sources to fetch the latest releases: Debian GNU/Linux ---------------- etch: deb https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/premium/ debian-etch/syslog-ng-2.1 syslog-ng-pe RedHat Enterprise Linux ----------------------- RHEL-4 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/premium/ rhel-4/syslog-ng-2.1 syslog-ng-pe SUSE 10 ------- SUSE 10.0 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/premium/ suse-10.0/syslog-ng-2.1 syslog-ng-pe SUSE 10.1 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/premium/ suse-10.1/syslog-ng-2.1 syslog-ng-pe HTTP can also be used in the place of HTTPS If your version of apt-get does not support the HTTPS protocol. When using plain HTTP, the username and password will not be encrypted.

1 1

syslog-ng Premium Edition 2.1.8 has been released
by devel＠balabit.hu 03 Dec '07

03 Dec '07

------------------------------------------------------------------------------ PACKAGE : syslog-ng Premium Edition VERSION : 2.1.8 SUMMARY : new stable release DATE : Dec 3, 2007 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Premium Edition (2.1.8) has been released. For latest fixes in the 2.1.x branch you are recommended to upgrade to this version. CHANGES: 2.1.8 Tue, 27 Nov 2007 10:49:31 +0100 IMPORTANT NOTES: * This version of syslog-ng contains a fix for a possible Denial of Service, therefore it is strongly recommended to upgrade to this release. Bugfixes: * Fixed the reversed field order for SQL destinations, when the configuration file contains an explicit list of fields. * Fixed a possible segmentation fault for IPv6 destinations. * Fixed the scope id resolution for link-local IPv6 addresses. * Fixed a problem in handling messages which lacked explicit timezone information, but the administrator specified a timezone for the messages. * Fixed some minor memory leaks in configuration reloads. * Fail the configuration initialization for an unresolvable domain name, instead of falling back to 0.0.0.0. * Fixed a segmentation fault which occurred when the timestamp of the incoming messages did not end with a space character (NULL pointer dereference). This is an easy Denial of Service possibility. * Corrected program name parsing in incoming messages. Other changes: * Added the --seed command line option that allows the administrator to seed the PRNG using a file, if the operating system does not provide a /dev/random device. DOWNLOAD: Download the latest binaries from: http://www.balabit.com/downloads/files/syslog-ng/binaries/premium-edition/ OR, if you have a platform that is supported by apt-get, use the following apt sources to fetch the latest releases: Debian GNU/Linux ---------------- etch: deb https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/premium/ debian-etch/syslog-ng-2.1 syslog-ng-pe RedHat Enterprise Linux ----------------------- RHEL-4 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/premium/ rhel-4/syslog-ng-2.1 syslog-ng-pe SUSE 10 ------- SUSE 10.0 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/premium/ suse-10.0/syslog-ng-2.1 syslog-ng-pe SUSE 10.1 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/premium/ suse-10.1/syslog-ng-2.1 syslog-ng-pe HTTP can also be used in the place of HTTPS If your version of apt-get does not support the HTTPS protocol. When using plain HTTP, the username and password will not be encrypted.

1 0

syslog-ng Agent for Windows 2.1.4 has been released
by devel＠balabit.hu 28 Nov '07

28 Nov '07

------------------------------------------------------------------------------ PACKAGE : syslog-ng Agent for Windows VERSION : 2.1.4 SUMMARY : new stable release DATE : Nov 26, 2007 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Agent for Windows (2.1.4) has been released. For latest fixes in the 2.1.x branch you are recommended to upgrade to this version. CHANGES: New features: * When checking the server's certificate, the agent now accepts a wildcard in the Common Name, e.g., *.example.com. * A new macro called $MONTHNAME is available that returns the three-character abbreviation of the monthname in English (e.g., Jan, Feb, etc.). * When using mutual authentication and the subject of the client's certificate is not set in the ClientCertSubject registry key, the agent tries to find a certificate that has the host name or the IP address of the syslog-ng server in its Common Name (whichever is set in the Server name parameter of the syslog-ng agent). * When uninstalling the agent from a host, it is now possible to automatically remove all configuration data from the registry. Bugfixes: * The agent sends the 'Failed to find client certificate' error message into the event log if it cannot find a certificate suitable for the server's request. * The agent checks if the server's certificate is not on a certificate revocation list (CRL). * The validity period of the server's certificate was incorrectly checked in certain situations. This behavior has been corrected. DOWNLOAD: Download the latest binaries from: http://www.balabit.com/downloads/files/syslog-ng/binaries/syslog-ng-agent/

1 0

syslog-ng 2.0.6 has been released
by devel＠balabit.hu 28 Nov '07

28 Nov '07

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 2.0.6 SUMMARY : new stable release DATE : Nov 28, 2007 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (2.0.6) has been released. For latest fixes in the 2.0.x branch you are recommended to upgrade to this version. CHANGES: 2.0.6 Tue, 27 Nov 2007 10:35:27 +0100 IMPORTANT NOTES: * There are two possible Denial of Service fixes in this version of syslog-ng, therefore it is strongly recommended to upgrade to this version. Bugfixes: * HP-UX related build and runtime fixes, backported from the Premium Edition. * If unable to resolve the name of the target host, syslog-ng failed to initialize the TCP/UDP destination drivers. This behavior has been corrected. * Corrected program name parsing in incoming messages. * Fixed a problem in handling messages which lacked explicit timezone information, but the administrator specified a timezone for the messages. * Fixed some minor memory leaks in configuration reloads. * Fixed a segmentation fault which occurred when the timestamp of the incoming messages did not end with a space character (NULL pointer dereference). This is an easy Denial of Service possibility. * Fixed a segmentation fault which occurred when the PID macro was used and the message had a closing bracket (']') before an opening bracket ('['). * Fixed a possible segmentation fault for UDP6/TCP6 destinations. * Fixed IPv6 scope id resolution for link-local addresses. * Solaris related fixes. BINARY DOWNLOAD: If you have a binary subscription, you can download the latest binaries from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… OR, if you have a platform that is supported by apt-get, use the following apt sources to fetch the latest releases: Debian GNU/Linux ---------------- sarge: deb https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ debian-sarge/syslog-ng-2.0 syslog-ng etch: deb https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ debian-etch/syslog-ng-2.0 syslog-ng RedHat Enterprise Linux ----------------------- RHEL-4 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ rhel-4/syslog-ng-2.0 syslog-ng SUSE 10 ------- SUSE 10.0 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ suse-10.0/syslog-ng-2.0 syslog-ng SUSE 10.1 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ suse-10.1/syslog-ng-2.0 syslog-ng HTTP can also be used in the place of HTTPS If your version of apt-get does not support the HTTPS protocol. When using plain HTTP, the username and password will not be encrypted. SOURCE DOWNLOAD: The latest versions of syslog-ng in source format can be found at: http://www.balabit.com/downloads/files/syslog-ng/sources/2.0/src/

1 0

syslog-ng Premium Edition 2.1.7b has been released
by devel＠balabit.hu 13 Nov '07

13 Nov '07

------------------------------------------------------------------------------ PACKAGE : syslog-ng Premium Edition VERSION : 2.1.7b SUMMARY : new stable release DATE : Nov 9, 2007 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Premium Edition (2.1.7b) has been released. For latest fixes in the 2.1.x branch you are recommended to upgrade to this version. CHANGES: 2.1.7b Wed, 07 Nov 2007 08:32:18 +0100 Bugfixes: * Fixed some Oracle interoperability issues in the SQL driver. 2.1.7a Mon, 05 Nov 2007 17:06:35 +0100 Bugfixes: * Fixed a database-thread scheduling problem that caused the database thread to wake up too frequently to check whether the connection to the database existed. This problem caused a high load on the server running syslog-ng. * Fixed a Solaris 8/9 related build problem that caused the SQL destination driver to be omitted from the compilation (affects 2.1.7 only) DOWNLOAD: Download the latest binaries from: http://www.balabit.com/downloads/files/syslog-ng/binaries/premium-edition/ OR, if you have a platform that is supported by apt-get, use the following apt sources to fetch the latest releases: Debian GNU/Linux ---------------- etch: deb https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/premium/ debian-etch/syslog-ng-2.1 syslog-ng-pe RedHat Enterprise Linux ----------------------- RHEL-4 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/premium/ rhel-4/syslog-ng-2.1 syslog-ng-pe SUSE 10 ------- SUSE 10.0 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/premium/ suse-10.0/syslog-ng-2.1 syslog-ng-pe SUSE 10.1 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/premium/ suse-10.1/syslog-ng-2.1 syslog-ng-pe HTTP can also be used in the place of HTTPS If your version of apt-get does not support the HTTPS protocol. When using plain HTTP, the username and password will not be encrypted.

1 0

syslog-ng Agent for Windows 2.1.3 has been released
by devel＠balabit.hu 13 Nov '07

13 Nov '07

------------------------------------------------------------------------------ PACKAGE : syslog-ng Agent for Windows VERSION : 2.1.3 SUMMARY : new stable release DATE : Nov 7, 2007 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Agent for Windows (2.1.3) has been released. For latest fixes in the 2.1.x branch you are recommended to upgrade to this version. CHANGES: 2.1.3 Wed, 7 November 2007 13:20:55 +0200 New features: * The syslog-ng agent now supports both the ISO and the BSD-style timestamp format. * Several new macros are available for different parts of the timestamp (day, hour, etc.). See 'The syslog-ng Administrator Guide' at http://www.balabit.com/support/documentation/ for details. * The SID field of event log entries is resolved into names. These names are also available using the new $EVENT_SID_TYPE macro. Bugfixes: * In log files, lines that did not end with a line break were not handled properly. This behavior has been corrected. * In certain cases, the agent did not properly handle the EventID parameter of log events. This behavior has been corrected. * Corrections in the behavior of the $EVENT_SID and $EVENT_NAME macros. * Event log messages do not always include the entire message in the event log; messages may refer to message parts that are stored in DLLs. When a referenced DLL was not available, or did not contain the referenced message, the syslog-ng agent returned an error message. Now it sends the message as it is included in the event log, so the references are visible in the syslog message. DOWNLOAD: Download the latest binaries from: http://www.balabit.com/downloads/files/syslog-ng/binaries/syslog-ng-agent/

1 0

syslog-ng 1.6.x has been released
by devel＠balabit.hu 24 Oct '07

24 Oct '07

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 1.6.x SUMMARY : end of life DATE : Oct 24, 2007 ------------------------------------------------------------------------------ DESCRIPTION: The maintenance and support of the syslog-ng 1.6.x product branch ends on December 1, 2007. There will not be any new releases in the 1.6.x branch. Users of syslog-ng 1.6.x are recommended to upgrade to the latest supported version: syslog-ng Open Source Edition v2.0.5 or syslog-ng Premium Edition v2.1.7. The Premium Edition of syslog-ng is a commercial product with advanced features like native SSL/TLS encryption support, direct database access, or disk-based message buffering. For details about syslog-ng Premium Edition, see http://www.balabit.com/network-security/syslog-ng/central-syslog-server/ A comparison between the Open Source and Premium editions is available at http://www.balabit.com/network-security/syslog-ng/central-syslog-server/com… For customers who bought support for syslog-ng, their support contract is automatically valid for the syslog-ng Open Source Edition 2.0.x product branch. Customers who bought binary subscription for syslog-ng 1.6.x within the last year may download the latest syslog-ng 2.0.x binaries for their platform until their subscription expires. FURTHER INFORMATION: The source code for the syslog-ng 2.0.x product branch is available at: http://www.balabit.com/downloads/files/syslog-ng/sources/stable/src/ The binaries for the syslog-ng 2.0.x product branch are available at: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system…

1 0

syslog-ng Premium Edition 2.1.7 has been released
by devel＠balabit.hu 12 Oct '07

12 Oct '07

------------------------------------------------------------------------------ PACKAGE : syslog-ng Premium Edition VERSION : 2.1.7 SUMMARY : new stable release DATE : Oct 12, 2007 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Premium Edition (2.1.7) has been released. For latest fixes in the 2.1.x branch you are recommended to upgrade to this version. CHANGES: 2.1.7 Fri, 12 Oct 2007 11:26:32 +0200 Bugfixes: * Fixed a possible segmentation fault when using the SQL destination under high load. * Fixed a possible segmentation fault when using the PID macro and an incorrectly formatted message. This is a denial of service possibility, no other risks are known to exist. * Fixed the default location of the configuration file in the Solaris init script. * A new binary package is available for Linux-From-Scratch 6.3. DOWNLOAD: Download the latest binaries from: http://www.balabit.com/downloads/files/syslog-ng/binaries/premium-edition/ OR, if you have a platform that is supported by apt-get, use the following apt sources to fetch the latest releases: Debian GNU/Linux ---------------- etch: deb https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/premium/ debian-etch/syslog-ng-2.1 syslog-ng-pe RedHat Enterprise Linux ----------------------- RHEL-4 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/premium/ rhel-4/syslog-ng-2.1 syslog-ng-pe SUSE 10 ------- SUSE 10.0 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/premium/ suse-10.0/syslog-ng-2.1 syslog-ng-pe SUSE 10.1 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/premium/ suse-10.1/syslog-ng-2.1 syslog-ng-pe HTTP can also be used in the place of HTTPS If your version of apt-get does not support the HTTPS protocol. When using plain HTTP, the username and password will not be encrypted.

1 0

syslog-ng Agent for Windows 2.1.2 has been released
by devel＠balabit.hu 03 Oct '07

03 Oct '07

------------------------------------------------------------------------------ PACKAGE : syslog-ng Agent for Windows VERSION : 2.1.2 SUMMARY : new stable release DATE : Sep 25, 2007 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Agent for Windows (2.1.2) has been released. For latest fixes in the 2.1.x branch you are recommended to upgrade to this version. CHANGES: 2.1.2 Tue, 25 September 2007 13:20:55 +0200 Bugfixes: * Corrections in the authentication of the server during mutual authentication. Features: * If an external application deletes some parts of a file source, the syslog-ng agent resends the contents of the entire file to the server. DOWNLOAD: Download the latest binaries from: http://www.balabit.com/downloads/files/syslog-ng/binaries/syslog-ng-agent/

1 0