← Vulnerability feed

Vulnerability record · CVE-2011-0343 · published 28 January 2011

CVE-2011-0343: Oneidentity syslog-ng permissions and access controls vulnerability

Oneidentity · Syslog Ng

Balabit syslog-ng 2.0, 3.0, 3.1, 3.2 OSE and PE, when running on FreeBSD or HP-UX, does not properly perform cast operations, which causes syslog-ng to use a default value of -1 to create log files with insecure permissions (07777), which allows local users to read and write to these log files.

6.9 CVSS 2.0 Medium EPSS 0.38% · top 70.9% CWE-264 · Permissions and access controls
6.9CVSS 2.0 base score
0.38%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
10References
16 Jun 2026Last modified by NVD

Description

Balabit syslog-ng 2.0, 3.0, 3.1, 3.2 OSE and PE, when running on FreeBSD or HP-UX, does not properly perform cast operations, which causes syslog-ng to use a default value of -1 to create log files with insecure permissions (07777), which allows local users to read and write to these log files.

AV:L/AC:M/Au:N/C:C/I:C/A:C

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=608491 PatchThird Party Advisory
http://www.securityfocus.com/archive/1/515955/100/0/threaded Third Party AdvisoryVDB Entry
http://www.securityfocus.com/bid/45988 Third Party AdvisoryVDB Entry
https://lists.balabit.com/pipermail/syslog-ng-announce/2011-January/000101.html Vendor Advisory
https://lists.balabit.com/pipermail/syslog-ng-announce/2011-January/000102.html Vendor Advisory
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=608491 PatchThird Party Advisory
http://www.securityfocus.com/archive/1/515955/100/0/threaded Third Party AdvisoryVDB Entry
http://www.securityfocus.com/bid/45988 Third Party AdvisoryVDB Entry
https://lists.balabit.com/pipermail/syslog-ng-announce/2011-January/000101.html Vendor Advisory
https://lists.balabit.com/pipermail/syslog-ng-announce/2011-January/000102.html Vendor Advisory

Track CVE-2011-0343 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.3CVE-2008-5110Oneidentity syslog-ng vulnerabilitysyslog-ng does not call chdir when it calls chroot, which might allow attackers to escape the intended jail. NOTE: this is only a vulnerability when …EPSS 2.2%7.8CVE-2020-8019Oneidentity syslog-ng vulnerabilityA UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of syslog-ng of SUSE Linux Enterprise Debuginfo 11-SP3, SUSE Linux Enterprise…EPSS 0.52%7.5CVE-2024-47619Oneidentity syslog-ng improper certificate validation vulnerabilitysyslog-ng is an enhanced log daemo. Prior to version 4.8.2, `tls_wildcard_match()` matches on certificates such as `foo.*.bar` although that is not a…EPSS 0.35%7.5CVE-2022-38725Oneidentity syslog-ng integer overflow vulnerabilityAn integer overflow in the RFC3164 parser in One Identity syslog-ng 3.0 through 3.37 allows remote attackers to cause a Denial of Service via crafted…EPSS 2.4%7.5CVE-2002-1200Oneidentity syslog-ng memory buffer overflow vulnerabilityBalabit Syslog-NG 1.4.x before 1.4.15, and 1.5.x before 1.5.20, when using template filenames or output, does not properly track the size of a buffer…EPSS 5.6%4.3CVE-2011-1951Oneidentity syslog-ng vulnerabilitylib/logmatcher.c in Balabit syslog-ng before 3.2.4, when the global flag is set and when using PCRE 8.12 and possibly other versions, allows remote a…EPSS 2.5%5.1CVE-2015-3246libuser userhelper direct /etc/passwd write race conditionlibuser before 0.56.13-8 and 0.60 before 0.60-7, as used by the userhelper program in the usermode package, modifies /etc/passwd directly instead of …KEVEPSS 8.8%analysed6.6CVE-2015-1769Windows Mount Manager symlink mishandling allows local privilege escalationThe Windows Mount Manager mishandles symbolic links, allowing a crafted USB device to trigger arbitrary code execution. Because the flaw is in a core…KEVEPSS 4.1%analysed

Source: NIST National Vulnerability Database (record CVE-2011-0343), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.