PT-2011-3210 · Suse · Logrotate

Ludwig Nussel · Published 2011-03-30 · Updated 2011-04-07 · CVE-2011-1550

Positive Technologies (AI Summary)

CVSS v2.0

6.3

Medium

Base vector

AV:L/AC:M/Au:N/C:N/I:C/A:C

Name of the Vulnerable Software and Affected Versions logrotate on SUSE openSUSE Factory

Description The issue arises from the default configuration of logrotate, which uses root privileges to process files in directories that allow non-root write access. This lack of support for untrusted directories enables local users to perform symlink and hard link attacks. The vulnerability can be demonstrated in directories for various packages, including cobbler, inn, safte-monitor, and uucp.

Recommendations For logrotate on SUSE openSUSE Factory, consider reconfiguring logrotate to avoid processing files in directories with non-root write access as a temporary workaround. Restrict access to these directories to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2011-1550

Affected Products

Logrotate

References · 35

• https://nvd.nist.gov/vuln/detail/CVE-2011-1550 · Security Note
• http://openwall.com/lists/oss-security/2011/03/04/27 · Note
• http://openwall.com/lists/oss-security/2011/03/04/19 · Note
• http://openwall.com/lists/oss-security/2011/03/04/18 · Note
• http://openwall.com/lists/oss-security/2011/03/04/30 · Note
• http://openwall.com/lists/oss-security/2011/03/06/3 · Note
• http://openwall.com/lists/oss-security/2011/03/04/28 · Note
• http://openwall.com/lists/oss-security/2011/03/11/3 · Note
• http://openwall.com/lists/oss-security/2011/03/06/6 · Note
• http://openwall.com/lists/oss-security/2011/03/04/24 · Note
• http://openwall.com/lists/oss-security/2011/03/23/11 · Note
• http://openwall.com/lists/oss-security/2011/03/08/5 · Note
• http://openwall.com/lists/oss-security/2011/03/05/8 · Note
• http://openwall.com/lists/oss-security/2011/03/04/32 · Note
• http://openwall.com/lists/oss-security/2011/03/06/4 · Note