PT-2011-1094 · Logrotate+2 · Logrotate+2
Published
2011-03-30
·
Updated
2024-09-19
·
CVE-2011-1155
CVSS v2.0
6.9
Medium
| Vector | AV:L/AC:M/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
logrotate versions 3.7.9 and earlier
logrotate versions prior to 3.8.0
Description
The issue might allow context-dependent attackers to cause a denial of service via a newline or backslash character in a log filename. Multiple vulnerabilities in the logrotate package can lead to disruption of confidentiality, integrity, and availability of protected information. Exploitation of these vulnerabilities can be carried out locally.
Recommendations
For logrotate versions 3.7.9 and earlier, update to version 3.8.0 or later to resolve the issue.
For logrotate versions prior to 3.8.0, update to version 3.8.0 or later to resolve the issue.
As a temporary workaround, consider restricting the use of the
writeState function in logrotate.c until a patch is available.
Avoid using newline or backslash characters in log filenames to minimize the risk of exploitation.Fix
DoS
Race Condition
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Red Hat
Logrotate