PT-2011-1093 · Logrotate+2 · Logrotate+2

Published 2011-03-30 · Updated 2024-09-19 · CVE-2011-1154

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Medium

Base vector

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions logrotate versions 3.7.9 and earlier logrotate versions prior to 3.8.0

Description The issue allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a log filename. This can be demonstrated by a filename that is automatically constructed on the basis of a hostname or virtual machine name. Exploitation of the vulnerabilities can lead to disruption of confidentiality, integrity, and availability of protected information and can be performed locally.

Recommendations For logrotate versions 3.7.9 and earlier, update to version 3.8.0 or later. For logrotate versions prior to 3.8.0, update to version 3.8.0 or later. As a temporary workaround, consider restricting access to the shred file function in logrotate.c until a patch is available.

Fix

RCE

Race Condition

Weakness Enumeration

CWE-20

CWE-362

Related Identifiers

ALT-PU-2015-2093

ALT-PU-2023-1925

ALT-PU-2024-11877

ALT-PU-2024-12867

BDU:2015-06014

BDU:2015-06015

BDU:2015-09654

CVE-2011-1154

OPENSUSE-SU-2024:10231-1

RHSA-2011:0407

RHSA-2011_0407

Affected Products

Alt Linux

Red Hat

Logrotate

References · 70

• https://errata.altlinux.org/ALT-PU-2023-1925 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-1154 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=680796 · Patch
• https://errata.altlinux.org/ALT-PU-2015-2093 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09654 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10231-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1098 · Security Note
• https://linux.oracle.com/errata/ELSA-2011-0407.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-06014 · Security Note
• http://vupen.com/english/advisories/2011/0791 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2011:065 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-06015 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2011-1154 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2024-12867 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-1154 · Vendor Advisory