|Check Point Reference:||SBP-2007-02|
|Date Published:||18 Oct 2006|
|Last Updated:||8 Aug 2016|
|Protection Provided by:||
|Who is Vulnerable?|
|Vulnerability Description||Syslog is a standard for transporting event notification messages over IP networks to event message collectors, or Syslog servers. Syslog is often used for system management and security auditing. Syslog servers, by default, listen on UDP port 514.RFC 3164 recommends that the source port be UDP/514.A Syslog message originating from a source port other than UDP/514 may indicate that it was generated by a process other than Syslog. This free choice of source port may be used by attackers to forge or spoof Syslog messages against some Syslog implementations.|
This protection will detect and block Syslog messages that have a source port other than UDP/514. The detect mode makes it possible to track irregular source portmessages without blocking them.
In order for the protection to be activated, update your Security Gateway product to the latest IPS update.For information on how to update IPS, go to SBP-2006-05, click on Protection tab and select the version of your choice.
This protection's log will contain the following information:
Attack Name: Syslog Protocol Violation.
Attack Information: The source port of a Syslog message is not UDP/514