Syslog flood

Risk Level: Medium risk vulnerability  Medium

Check or Attack Name: syslogflood

Platforms: Unix
Description:

This system was found to be vulnerable to Syslog Flood. Sending a large number of messages to the system log daemon can be used to cause a denial of service attack by exhausting disk space. This attack can lead to the syslog service terminating, or possibly a system deadlock, putting the host in an inoperable state.

Remedy:

If you are not using remote logging, use the -r option (or -l in BSDI) to turn remote logging off in your syslog daemon. You must then recompile the daemon. Contact your vendor or refer to your vendor's documentation for more information.

References:

X-Force Logo
Know Your Risks