CVE-2002-1200

Name: CVE-2002-1200
Creator: NVD / NIST
Published: 2002-10-28T05:00:00+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

UnknownEPSS 5.58%

Last modified Jun 16, 2026

CVE-2002-1200 is a vulnerability of currently unknown severity. Balabit Syslog-NG 1.4.x before 1.4.15, and 1.5.x before 1.5.20, when using template filenames or output, does not properly track the size of a buffer when constant characters are encountered during macro expansion, which allows remote attackers to cause a denial of service and possibly execute arbitrary code.. EPSS estimates a 5.58% chance of exploitation in the next 30 days.

Description

Balabit Syslog-NG 1.4.x before 1.4.15, and 1.5.x before 1.5.20, when using template filenames or output, does not properly track the size of a buffer when constant characters are encountered during macro expansion, which allows remote attackers to cause a denial of service and possibly execute arbitrary code.

Metrics

EPSS Probability

5.58%

91.9th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-119

Affected Software

Vendor	Product	Versions	Update
Oneidentity	Syslog-Ng	1.4.0	Rc3
Oneidentity	Syslog-Ng	1.4.7	—
Oneidentity	Syslog-Ng	1.4.8	—
Oneidentity	Syslog-Ng	1.4.9	—
Oneidentity	Syslog-Ng	1.4.10	—
Oneidentity	Syslog-Ng	1.4.15	—
Oneidentity	Syslog-Ng	1.5.15	—
Oneidentity	Syslog-Ng	1.5.20	—

References

http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000547Broken Link
http://marc.info/?l=bugtraq&m=103426595021928&w=2Third Party Advisory
http://www.balabit.hu/static/zsa/ZSA-2002-014-en.txtExploit, Patch, Vendor Advisory
http://www.debian.org/security/2002/dsa-175Patch, Third Party Advisory
http://www.iss.net/security_center/static/10339.phpThird Party Advisory
http://www.linuxsecurity.com/advisories/other_advisory-2513.htmlThird Party Advisory
http://www.novell.com/linux/security/advisories/2002_039_syslog_ng.htmlThird Party Advisory
http://www.securityfocus.com/bid/5934Exploit, Third Party Advisory, VDB Entry
http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000547Broken Link
http://marc.info/?l=bugtraq&m=103426595021928&w=2Third Party Advisory
http://www.balabit.hu/static/zsa/ZSA-2002-014-en.txtExploit, Patch, Vendor Advisory
http://www.debian.org/security/2002/dsa-175Patch, Third Party Advisory
http://www.iss.net/security_center/static/10339.phpThird Party Advisory
http://www.linuxsecurity.com/advisories/other_advisory-2513.htmlThird Party Advisory
http://www.novell.com/linux/security/advisories/2002_039_syslog_ng.htmlThird Party Advisory
http://www.securityfocus.com/bid/5934Exploit, Third Party Advisory, VDB Entry

Timeline

Published: Oct 28, 2002
Last Modified: Jun 16, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2002-1200?

How severe is CVE-2002-1200?

Severity scoring for CVE-2002-1200 is pending analysis. The EPSS model estimates a 5.58% probability of exploitation in the next 30 days.

How do I fix CVE-2002-1200?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2002-1200?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST