Vulnerabilities > CVE-2011-1155 - Resource Management Errors vulnerability in Gentoo Logrotate

047910
CVSS 1.9 - LOW
Attack vector
LOCAL
Attack complexity
MEDIUM
Privileges required
NONE
Confidentiality impact
NONE
Integrity impact
NONE
Availability impact
PARTIAL
local
gentoo
CWE-399
nessus

Summary

The writeState function in logrotate.c in logrotate 3.7.9 and earlier might allow context-dependent attackers to cause a denial of service (rotation outage) via a (1) \n (newline) or (2) \ (backslash) character in a log filename, as demonstrated by a filename that is automatically constructed on the basis of a hostname or virtual machine name.

Common Weakness Enumeration (CWE)

Nessus

  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-201206-36.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-201206-36 (logrotate: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in logrotate. Please review the CVE identifiers referenced below for details. Impact : A local attacker could use this flaw to truncate arbitrary system file, to change file owner or mode on arbitrary system files, to conduct symlink attacks and send arbitrary system files, to execute arbitrary system commands, to cause abort in subsequent logrotate runs, to disclose sensitive information, to execute arbitrary code or cause a Denial of Service condition. Workaround : There is no known workaround at this time.
    last seen2020-06-01
    modified2020-06-02
    plugin id59709
    published2012-06-26
    reporterThis script is Copyright (C) 2012-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/59709
    titleGLSA-201206-36 : logrotate: Multiple vulnerabilities
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Gentoo Linux Security Advisory GLSA 201206-36.
    #
    # The advisory text is Copyright (C) 2001-2016 Gentoo Foundation, Inc.
    # and licensed under the Creative Commons - Attribution / Share Alike 
    # license. See http://creativecommons.org/licenses/by-sa/3.0/
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(59709);
      script_version("1.8");
      script_cvs_date("Date: 2018/07/11 17:09:26");
    
      script_cve_id("CVE-2011-1098", "CVE-2011-1154", "CVE-2011-1155", "CVE-2011-1549");
      script_bugtraq_id(47103, 47107, 47108, 47170);
      script_xref(name:"GLSA", value:"201206-36");
    
      script_name(english:"GLSA-201206-36 : logrotate: Multiple vulnerabilities");
      script_summary(english:"Checks for updated package(s) in /var/db/pkg");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:
    "The remote Gentoo host is missing one or more security-related
    patches."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "The remote host is affected by the vulnerability described in GLSA-201206-36
    (logrotate: Multiple vulnerabilities)
    
        Multiple vulnerabilities have been discovered in logrotate. Please
          review the CVE identifiers referenced below for details.
      
    Impact :
    
        A local attacker could use this flaw to truncate arbitrary system file,
          to change file owner or mode on arbitrary system files, to conduct
          symlink attacks and send arbitrary system files, to execute arbitrary
          system commands, to cause abort in subsequent logrotate runs, to disclose
          sensitive information, to execute arbitrary code or cause a Denial of
          Service condition.
      
    Workaround :
    
        There is no known workaround at this time."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security.gentoo.org/glsa/201206-36"
      );
      script_set_attribute(
        attribute:"solution", 
        value:
    "All logrotate users should upgrade to the latest version:
          # emerge --sync
          # emerge --ask --oneshot --verbose '>=app-admin/logrotate-3.8.0'"
      );
      script_set_cvss_base_vector("CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:logrotate");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:gentoo:linux");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2012/06/25");
      script_set_attribute(attribute:"plugin_publication_date", value:"2012/06/26");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2012-2018 Tenable Network Security, Inc.");
      script_family(english:"Gentoo Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/Gentoo/release", "Host/Gentoo/qpkg-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("qpkg.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Gentoo/release")) audit(AUDIT_OS_NOT, "Gentoo");
    if (!get_kb_item("Host/Gentoo/qpkg-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    
    if (qpkg_check(package:"app-admin/logrotate", unaffected:make_list("ge 3.8.0"), vulnerable:make_list("lt 3.8.0"))) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:qpkg_report_get());
      else security_warning(0);
      exit(0);
    }
    else
    {
      tested = qpkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "logrotate");
    }
    
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2011-3739.NASL
    descriptionFixes CVE-2011-1154, CVE-2011-1155 and CVE-2011-1098. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id53363
    published2011-04-12
    reporterThis script is Copyright (C) 2011-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/53363
    titleFedora 14 : logrotate-3.7.9-2.fc14 (2011-3739)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Fedora Security Advisory 2011-3739.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(53363);
      script_version("1.11");
      script_cvs_date("Date: 2019/08/02 13:32:35");
    
      script_cve_id("CVE-2011-1098", "CVE-2011-1154", "CVE-2011-1155");
      script_bugtraq_id(47103, 47107, 47108);
      script_xref(name:"FEDORA", value:"2011-3739");
    
      script_name(english:"Fedora 14 : logrotate-3.7.9-2.fc14 (2011-3739)");
      script_summary(english:"Checks rpm output for the updated package.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Fedora host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Fixes CVE-2011-1154, CVE-2011-1155 and CVE-2011-1098.
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the Fedora security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.redhat.com/show_bug.cgi?id=680796"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.redhat.com/show_bug.cgi?id=680797"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.redhat.com/show_bug.cgi?id=680798"
      );
      # https://lists.fedoraproject.org/pipermail/package-announce/2011-April/057845.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?c28693e3"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected logrotate package."
      );
      script_set_cvss_base_vector("CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:logrotate");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:14");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2011/03/21");
      script_set_attribute(attribute:"plugin_publication_date", value:"2011/04/12");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2011-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Fedora Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora");
    os_ver = eregmatch(pattern: "Fedora.*release ([0-9]+)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora");
    os_ver = os_ver[1];
    if (! ereg(pattern:"^14([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 14.x", "Fedora " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu);
    
    flag = 0;
    if (rpm_check(release:"FC14", reference:"logrotate-3.7.9-2.fc14")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
      else security_warning(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "logrotate");
    }
    
  • NASL familyF5 Networks Local Security Checks
    NASL idF5_BIGIP_SOL16871.NASL
    descriptionThe writeState function in logrotate.c in logrotate 3.7.9 and earlier might allow context-dependent attackers to cause a denial of service (rotation outage) via a (1) \n (newline) or (2) \ (backslash) character in a log filename, as demonstrated by a filename that is automatically constructed on the basis of a hostname or virtual machine name.
    last seen2020-06-01
    modified2020-06-02
    plugin id85953
    published2015-09-16
    reporterThis script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/85953
    titleF5 Networks BIG-IP : logrotate vulnerability (SOL16871)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from F5 Networks BIG-IP Solution SOL16871.
    #
    # The text description of this plugin is (C) F5 Networks.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(85953);
      script_version("2.4");
      script_cvs_date("Date: 2019/01/04 10:03:40");
    
      script_cve_id("CVE-2011-1155");
      script_bugtraq_id(47107);
    
      script_name(english:"F5 Networks BIG-IP : logrotate vulnerability (SOL16871)");
      script_summary(english:"Checks the BIG-IP version.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote device is missing a vendor-supplied security patch."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "The writeState function in logrotate.c in logrotate 3.7.9 and earlier
    might allow context-dependent attackers to cause a denial of service
    (rotation outage) via a (1) \n (newline) or (2) \ (backslash)
    character in a log filename, as demonstrated by a filename that is
    automatically constructed on the basis of a hostname or virtual
    machine name."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://support.f5.com/csp/article/K16871"
      );
      script_set_attribute(
        attribute:"solution", 
        value:
    "Upgrade to one of the non-vulnerable versions listed in the F5
    Solution SOL16871."
      );
      script_set_cvss_base_vector("CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:f5:big-ip_access_policy_manager");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:f5:big-ip_advanced_firewall_manager");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:f5:big-ip_application_acceleration_manager");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:f5:big-ip_application_security_manager");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:f5:big-ip_application_visibility_and_reporting");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:f5:big-ip_global_traffic_manager");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:f5:big-ip_link_controller");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:f5:big-ip_local_traffic_manager");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:f5:big-ip_policy_enforcement_manager");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:f5:big-ip_wan_optimization_manager");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:f5:big-ip_webaccelerator");
      script_set_attribute(attribute:"cpe", value:"cpe:/h:f5:big-ip");
      script_set_attribute(attribute:"cpe", value:"cpe:/h:f5:big-ip_protocol_security_manager");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2015/07/08");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_set_attribute(attribute:"plugin_publication_date", value:"2015/09/16");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"F5 Networks Local Security Checks");
    
      script_dependencies("f5_bigip_detect.nbin");
      script_require_keys("Host/local_checks_enabled", "Host/BIG-IP/hotfix", "Host/BIG-IP/modules", "Host/BIG-IP/version");
    
      exit(0);
    }
    
    
    include("f5_func.inc");
    
    if ( ! get_kb_item("Host/local_checks_enabled") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    version = get_kb_item("Host/BIG-IP/version");
    if ( ! version ) audit(AUDIT_OS_NOT, "F5 Networks BIG-IP");
    if ( isnull(get_kb_item("Host/BIG-IP/hotfix")) ) audit(AUDIT_KB_MISSING, "Host/BIG-IP/hotfix");
    if ( ! get_kb_item("Host/BIG-IP/modules") ) audit(AUDIT_KB_MISSING, "Host/BIG-IP/modules");
    
    sol = "SOL16871";
    vmatrix = make_array();
    
    # AFM
    vmatrix["AFM"] = make_array();
    vmatrix["AFM"]["affected"  ] = make_list("11.3.0-11.6.0");
    vmatrix["AFM"]["unaffected"] = make_list("12.0.0");
    
    # AM
    vmatrix["AM"] = make_array();
    vmatrix["AM"]["affected"  ] = make_list("11.4.0-11.6.0");
    vmatrix["AM"]["unaffected"] = make_list("12.0.0");
    
    # APM
    vmatrix["APM"] = make_array();
    vmatrix["APM"]["affected"  ] = make_list("11.0.0-11.6.0","10.1.0-10.2.4");
    vmatrix["APM"]["unaffected"] = make_list("12.0.0");
    
    # ASM
    vmatrix["ASM"] = make_array();
    vmatrix["ASM"]["affected"  ] = make_list("11.0.0-11.6.0","10.0.0-10.2.4");
    vmatrix["ASM"]["unaffected"] = make_list("12.0.0");
    
    # AVR
    vmatrix["AVR"] = make_array();
    vmatrix["AVR"]["affected"  ] = make_list("11.0.0-11.6.0");
    vmatrix["AVR"]["unaffected"] = make_list("12.0.0");
    
    # LC
    vmatrix["LC"] = make_array();
    vmatrix["LC"]["affected"  ] = make_list("11.0.0-11.6.0","10.0.0-10.2.4");
    vmatrix["LC"]["unaffected"] = make_list("12.0.0");
    
    # LTM
    vmatrix["LTM"] = make_array();
    vmatrix["LTM"]["affected"  ] = make_list("11.0.0-11.6.0","10.0.0-10.2.4");
    vmatrix["LTM"]["unaffected"] = make_list("12.0.0");
    
    # PEM
    vmatrix["PEM"] = make_array();
    vmatrix["PEM"]["affected"  ] = make_list("11.3.0-11.6.0");
    vmatrix["PEM"]["unaffected"] = make_list("12.0.0");
    
    
    if (bigip_is_affected(vmatrix:vmatrix, sol:sol))
    {
      if (report_verbosity > 0) security_note(port:0, extra:bigip_report_get());
      else security_note(0);
      exit(0);
    }
    else
    {
      tested = bigip_get_tested_modules();
      audit_extra = "For BIG-IP module(s) " + tested + ",";
      if (tested) audit(AUDIT_INST_VER_NOT_VULN, audit_extra, version);
      else audit(AUDIT_HOST_NOT, "running any of the affected modules");
    }
    
  • NASL familySuSE Local Security Checks
    NASL idSUSE_LOGROTATE-7533.NASL
    descriptionThis update for logrotate provides the following fixes : - Race condition in the createOutputFile function in logrotate allows local users to read log data by opening a file before the intended permissions are in place. (bnc#677336 / CVE-2011-1098) - The writeState function in logrotate might allow context-dependent attackers to cause a denial of service (rotation outage) via a (1) \n (newline) or (2) \ (backslash) character in a log filename, as demonstrated by a filename that is automatically constructed on the basis of a hostname or virtual machine name. (bnc#679662 / CVE-2011-1155)
    last seen2020-06-01
    modified2020-06-02
    plugin id57224
    published2011-12-13
    reporterThis script is Copyright (C) 2011-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/57224
    titleSuSE 10 Security Update : logrotate (ZYPP Patch Number 7533)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The text description of this plugin is (C) Novell, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(57224);
      script_version ("1.5");
      script_cvs_date("Date: 2019/10/25 13:36:43");
    
      script_cve_id("CVE-2011-1098", "CVE-2011-1155");
    
      script_name(english:"SuSE 10 Security Update : logrotate (ZYPP Patch Number 7533)");
      script_summary(english:"Checks rpm output for the updated package");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote SuSE 10 host is missing a security-related patch."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "This update for logrotate provides the following fixes :
    
      - Race condition in the createOutputFile function in
        logrotate allows local users to read log data by opening
        a file before the intended permissions are in place.
        (bnc#677336 / CVE-2011-1098)
    
      - The writeState function in logrotate might allow
        context-dependent attackers to cause a denial of service
        (rotation outage) via a (1) \n (newline) or (2) \
        (backslash) character in a log filename, as demonstrated
        by a filename that is automatically constructed on the
        basis of a hostname or virtual machine name. (bnc#679662
        / CVE-2011-1155)"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2011-1098.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2011-1155.html"
      );
      script_set_attribute(attribute:"solution", value:"Apply ZYPP patch number 7533.");
      script_set_cvss_base_vector("CVSS2#AV:L/AC:M/Au:N/C:P/I:N/A:N");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:suse:suse_linux");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2011/05/18");
      script_set_attribute(attribute:"plugin_publication_date", value:"2011/12/13");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2011-2019 Tenable Network Security, Inc.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list");
    
      exit(0);
    }
    
    
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) exit(0, "Local checks are not enabled.");
    if (!get_kb_item("Host/SuSE/release")) exit(0, "The host is not running SuSE.");
    if (!get_kb_item("Host/SuSE/rpm-list")) exit(1, "Could not obtain the list of installed packages.");
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) exit(1, "Failed to determine the architecture type.");
    if (cpu >!< "x86_64" && cpu !~ "^i[3-6]86$") exit(1, "Local checks for SuSE 10 on the '"+cpu+"' architecture have not been implemented.");
    
    
    flag = 0;
    if (rpm_check(release:"SLED10", sp:4, reference:"logrotate-3.7.3-13.15.1")) flag++;
    if (rpm_check(release:"SLES10", sp:4, reference:"logrotate-3.7.3-13.15.1")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_note(port:0, extra:rpm_report_get());
      else security_note(0);
      exit(0);
    }
    else exit(0, "The host is not affected.");
    
  • NASL familySuSE Local Security Checks
    NASL idSUSE_LOGROTATE-7534.NASL
    descriptionThis update for logrotate provides the following fixes : - Race condition in the createOutputFile function in logrotate allows local users to read log data by opening a file before the intended permissions are in place (CVE-2011-1098). (bnc#677336) - The writeState function in logrotate might allow context-dependent attackers to cause a denial of service (rotation outage) via a (1) \n (newline) or (2) \ (backslash) character in a log filename, as demonstrated by a filename that is automatically constructed on the basis of a hostname or virtual machine name (CVE-2011-1155). (bnc#679662) - In addition, the missingok option has been improved
    last seen2020-06-01
    modified2020-06-02
    plugin id54829
    published2011-05-26
    reporterThis script is Copyright (C) 2011-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/54829
    titleSuSE 10 Security Update : logrotate (ZYPP Patch Number 7534)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The text description of this plugin is (C) Novell, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(54829);
      script_version ("1.7");
      script_cvs_date("Date: 2019/10/25 13:36:43");
    
      script_cve_id("CVE-2011-1098", "CVE-2011-1155");
    
      script_name(english:"SuSE 10 Security Update : logrotate (ZYPP Patch Number 7534)");
      script_summary(english:"Checks rpm output for the updated package");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote SuSE 10 host is missing a security-related patch."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "This update for logrotate provides the following fixes :
    
      - Race condition in the createOutputFile function in
        logrotate allows local users to read log data by opening
        a file before the intended permissions are in place
        (CVE-2011-1098). (bnc#677336)
    
      - The writeState function in logrotate might allow
        context-dependent attackers to cause a denial of service
        (rotation outage) via a (1) \n (newline) or (2) \
        (backslash) character in a log filename, as demonstrated
        by a filename that is automatically constructed on the
        basis of a hostname or virtual machine name
        (CVE-2011-1155). (bnc#679662)
    
      - In addition, the missingok option has been improved"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2011-1098.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2011-1155.html"
      );
      script_set_attribute(attribute:"solution", value:"Apply ZYPP patch number 7534.");
      script_set_cvss_base_vector("CVSS2#AV:L/AC:M/Au:N/C:P/I:N/A:N");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:suse:suse_linux");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2011/05/18");
      script_set_attribute(attribute:"plugin_publication_date", value:"2011/05/26");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2011-2019 Tenable Network Security, Inc.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list");
    
      exit(0);
    }
    
    
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) exit(0, "Local checks are not enabled.");
    if (!get_kb_item("Host/SuSE/release")) exit(0, "The host is not running SuSE.");
    if (!get_kb_item("Host/SuSE/rpm-list")) exit(1, "Could not obtain the list of installed packages.");
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) exit(1, "Failed to determine the architecture type.");
    if (cpu >!< "x86_64" && cpu !~ "^i[3-6]86$") exit(1, "Local checks for SuSE 10 on the '"+cpu+"' architecture have not been implemented.");
    
    
    flag = 0;
    if (rpm_check(release:"SLES10", sp:3, reference:"logrotate-3.7.3-13.13.3.1")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_note(port:0, extra:rpm_report_get());
      else security_note(0);
      exit(0);
    }
    else exit(0, "The host is not affected.");
    
  • NASL familyScientific Linux Local Security Checks
    NASL idSL_20110331_LOGROTATE_ON_SL6_X.NASL
    descriptionA shell command injection flaw was found in the way logrotate handled the shred directive. A specially crafted log file could cause logrotate to execute arbitrary commands with the privileges of the user running logrotate (root, by default). Note: The shred directive is not enabled by default. (CVE-2011-1154) A race condition flaw was found in the way logrotate applied permissions when creating new log files. In some specific configurations, a local attacker could use this flaw to open new log files before logrotate applies the final permissions, possibly leading to the disclosure of sensitive information. (CVE-2011-1098) An input sanitization flaw was found in logrotate. A log file with a specially crafted file name could cause logrotate to abort when attempting to process that file a subsequent time. (CVE-2011-1155)
    last seen2020-06-01
    modified2020-06-02
    plugin id61004
    published2012-08-01
    reporterThis script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/61004
    titleScientific Linux Security Update : logrotate on SL6.x i386/x86_64
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text is (C) Scientific Linux.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(61004);
      script_version("1.5");
      script_cvs_date("Date: 2019/10/25 13:36:19");
    
      script_cve_id("CVE-2011-1098", "CVE-2011-1154", "CVE-2011-1155");
    
      script_name(english:"Scientific Linux Security Update : logrotate on SL6.x i386/x86_64");
      script_summary(english:"Checks rpm output for the updated package");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Scientific Linux host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "A shell command injection flaw was found in the way logrotate handled
    the shred directive. A specially crafted log file could cause
    logrotate to execute arbitrary commands with the privileges of the
    user running logrotate (root, by default). Note: The shred directive
    is not enabled by default. (CVE-2011-1154)
    
    A race condition flaw was found in the way logrotate applied
    permissions when creating new log files. In some specific
    configurations, a local attacker could use this flaw to open new log
    files before logrotate applies the final permissions, possibly leading
    to the disclosure of sensitive information. (CVE-2011-1098)
    
    An input sanitization flaw was found in logrotate. A log file with a
    specially crafted file name could cause logrotate to abort when
    attempting to process that file a subsequent time. (CVE-2011-1155)"
      );
      # https://listserv.fnal.gov/scripts/wa.exe?A2=ind1104&L=scientific-linux-errata&T=0&P=204
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?6455943f"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected logrotate package."
      );
      script_set_cvss_base_vector("CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"x-cpe:/o:fermilab:scientific_linux");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2011/03/31");
      script_set_attribute(attribute:"plugin_publication_date", value:"2012/08/01");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Scientific Linux Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/RedHat/release", "Host/RedHat/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Scientific Linux " >!< release) audit(AUDIT_HOST_NOT, "running Scientific Linux");
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if (cpu >!< "x86_64" && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Scientific Linux", cpu);
    
    
    flag = 0;
    if (rpm_check(release:"SL6", reference:"logrotate-3.7.8-12.el6_0.1")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
      else security_warning(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2011-0407.NASL
    descriptionFrom Red Hat Security Advisory 2011:0407 : An updated logrotate package that fixes multiple security issues is now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. The logrotate utility simplifies the administration of multiple log files, allowing the automatic rotation, compression, removal, and mailing of log files. A shell command injection flaw was found in the way logrotate handled the shred directive. A specially crafted log file could cause logrotate to execute arbitrary commands with the privileges of the user running logrotate (root, by default). Note: The shred directive is not enabled by default. (CVE-2011-1154) A race condition flaw was found in the way logrotate applied permissions when creating new log files. In some specific configurations, a local attacker could use this flaw to open new log files before logrotate applies the final permissions, possibly leading to the disclosure of sensitive information. (CVE-2011-1098) An input sanitization flaw was found in logrotate. A log file with a specially crafted file name could cause logrotate to abort when attempting to process that file a subsequent time. (CVE-2011-1155) All logrotate users should upgrade to this updated package, which contains backported patches to resolve these issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id68243
    published2013-07-12
    reporterThis script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/68243
    titleOracle Linux 6 : logrotate (ELSA-2011-0407)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Red Hat Security Advisory RHSA-2011:0407 and 
    # Oracle Linux Security Advisory ELSA-2011-0407 respectively.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(68243);
      script_version("1.9");
      script_cvs_date("Date: 2019/10/25 13:36:09");
    
      script_cve_id("CVE-2011-1098", "CVE-2011-1154", "CVE-2011-1155");
      script_xref(name:"RHSA", value:"2011:0407");
    
      script_name(english:"Oracle Linux 6 : logrotate (ELSA-2011-0407)");
      script_summary(english:"Checks rpm output for the updated package");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Oracle Linux host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "From Red Hat Security Advisory 2011:0407 :
    
    An updated logrotate package that fixes multiple security issues is
    now available for Red Hat Enterprise Linux 6.
    
    The Red Hat Security Response Team has rated this update as having
    moderate security impact. Common Vulnerability Scoring System (CVSS)
    base scores, which give detailed severity ratings, are available for
    each vulnerability from the CVE links in the References section.
    
    The logrotate utility simplifies the administration of multiple log
    files, allowing the automatic rotation, compression, removal, and
    mailing of log files.
    
    A shell command injection flaw was found in the way logrotate handled
    the shred directive. A specially crafted log file could cause
    logrotate to execute arbitrary commands with the privileges of the
    user running logrotate (root, by default). Note: The shred directive
    is not enabled by default. (CVE-2011-1154)
    
    A race condition flaw was found in the way logrotate applied
    permissions when creating new log files. In some specific
    configurations, a local attacker could use this flaw to open new log
    files before logrotate applies the final permissions, possibly leading
    to the disclosure of sensitive information. (CVE-2011-1098)
    
    An input sanitization flaw was found in logrotate. A log file with a
    specially crafted file name could cause logrotate to abort when
    attempting to process that file a subsequent time. (CVE-2011-1155)
    
    All logrotate users should upgrade to this updated package, which
    contains backported patches to resolve these issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://oss.oracle.com/pipermail/el-errata/2011-March/002047.html"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected logrotate package."
      );
      script_set_cvss_base_vector("CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:logrotate");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:oracle:linux:6");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2011/03/30");
      script_set_attribute(attribute:"patch_publication_date", value:"2011/03/31");
      script_set_attribute(attribute:"plugin_publication_date", value:"2013/07/12");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Oracle Linux Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/OracleLinux", "Host/RedHat/release", "Host/RedHat/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/OracleLinux")) audit(AUDIT_OS_NOT, "Oracle Linux");
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || !pregmatch(pattern: "Oracle (?:Linux Server|Enterprise Linux)", string:release)) audit(AUDIT_OS_NOT, "Oracle Linux");
    os_ver = pregmatch(pattern: "Oracle (?:Linux Server|Enterprise Linux) .*release ([0-9]+(\.[0-9]+)?)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Oracle Linux");
    os_ver = os_ver[1];
    if (! preg(pattern:"^6([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Oracle Linux 6", "Oracle Linux " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Oracle Linux", cpu);
    
    flag = 0;
    if (rpm_check(release:"EL6", reference:"logrotate-3.7.8-12.el6_0.1")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
      else security_warning(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "logrotate");
    }
    
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-1172-1.NASL
    descriptionIt was discovered that logrotate incorrectly handled the creation of new log files. Local users could possibly read log files if they were opened before permissions were in place. This issue only affected Ubuntu 8.04 LTS. (CVE-2011-1098) It was discovered that logrotate incorrectly handled certain log file names when used with the shred option. Local attackers able to create log files with specially crafted filenames could use this issue to execute arbitrary code. This issue only affected Ubuntu 10.04 LTS, 10.10, and 11.04. (CVE-2011-1154) It was discovered that logrotate incorrectly handled certain malformed log filenames. Local attackers able to create log files with specially crafted filenames could use this issue to cause logrotate to stop processing log files, resulting in a denial of service. (CVE-2011-1155) It was discovered that logrotate incorrectly handled symlinks and hard links when processing log files. A local attacker having write access to a log file directory could use this issue to overwrite or read arbitrary files. This issue only affected Ubuntu 8.04 LTS. (CVE-2011-1548). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id55648
    published2011-07-22
    reporterUbuntu Security Notice (C) 2011-2019 Canonical, Inc. / NASL script (C) 2011-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/55648
    titleUbuntu 8.04 LTS / 10.04 LTS / 10.10 / 11.04 : logrotate vulnerabilities (USN-1172-1)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_4_LOGROTATE-110518.NASL
    descriptionThis update for logrotate provides the following fixes : dbg114-logrotate-4580 logrotate-4580 new_updateinfo The shred_file function in logrotate might allow context-dependent attackers to execute arbitrary commands via shell metacharacters in a log filename, as demonstrated by a filename that is automatically constructed on the basis of a hostname or virtual machine name (CVE-2011-1154) (bnc#679661) dbg114-logrotate-4580 logrotate-4580 new_updateinfo Race condition in the createOutputFile function in logrotate allows local users to read log data by opening a file before the intended permissions are in place (CVE-2011-1098) (bnc#677336) dbg114-logrotate-4580 logrotate-4580 new_updateinfo The writeState function in logrotate might allow context-dependent attackers to cause a denial of service (rotation outage) via a (1) n (newline) or (2) (backslash) character in a log filename, as demonstrated by a filename that is automatically constructed on the basis of a hostname or virtual machine name (CVE-2011-1155) (bnc#679662)
    last seen2020-06-01
    modified2020-06-02
    plugin id75942
    published2014-06-13
    reporterThis script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/75942
    titleopenSUSE Security Update : logrotate (openSUSE-SU-2011:0536-1)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2011-3758.NASL
    descriptionFixes CVE-2011-1154, CVE-2011-1155 and CVE-2011-1098. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id53199
    published2011-03-29
    reporterThis script is Copyright (C) 2011-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/53199
    titleFedora 15 : logrotate-3.7.9-8.fc15 (2011-3758)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_3_LOGROTATE-110518.NASL
    descriptionThis update for logrotate provides the following fixes : - The shred_file function in logrotate might allow context-dependent attackers to execute arbitrary commands via shell metacharacters in a log filename, as demonstrated by a filename that is automatically constructed on the basis of a hostname or virtual machine name (CVE-2011-1154) (bnc#679661) - Race condition in the createOutputFile function in logrotate allows local users to read log data by opening a file before the intended permissions are in place (CVE-2011-1098) (bnc#677336) - The writeState function in logrotate might allow context-dependent attackers to cause a denial of service (rotation outage) via a (1) \n (newline) or (2) \ (backslash) character in a log filename, as demonstrated by a filename that is automatically constructed on the basis of a hostname or virtual machine name (CVE-2011-1155) (bnc#679662)
    last seen2020-06-01
    modified2020-06-02
    plugin id75638
    published2014-06-13
    reporterThis script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/75638
    titleopenSUSE Security Update : logrotate (openSUSE-SU-2011:0536-1)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2011-0407.NASL
    descriptionAn updated logrotate package that fixes multiple security issues is now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. The logrotate utility simplifies the administration of multiple log files, allowing the automatic rotation, compression, removal, and mailing of log files. A shell command injection flaw was found in the way logrotate handled the shred directive. A specially crafted log file could cause logrotate to execute arbitrary commands with the privileges of the user running logrotate (root, by default). Note: The shred directive is not enabled by default. (CVE-2011-1154) A race condition flaw was found in the way logrotate applied permissions when creating new log files. In some specific configurations, a local attacker could use this flaw to open new log files before logrotate applies the final permissions, possibly leading to the disclosure of sensitive information. (CVE-2011-1098) An input sanitization flaw was found in logrotate. A log file with a specially crafted file name could cause logrotate to abort when attempting to process that file a subsequent time. (CVE-2011-1155) All logrotate users should upgrade to this updated package, which contains backported patches to resolve these issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id53246
    published2011-04-01
    reporterThis script is Copyright (C) 2011-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/53246
    titleRHEL 6 : logrotate (RHSA-2011:0407)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_LOGROTATE-110518.NASL
    descriptionThis update for logrotate provides the following fixes : - The shred_file function in logrotate might allow context-dependent attackers to execute arbitrary commands via shell metacharacters in a log filename, as demonstrated by a filename that is automatically constructed on the basis of a hostname or virtual machine name (CVE-2011-1154). (bnc#679661) - Race condition in the createOutputFile function in logrotate allows local users to read log data by opening a file before the intended permissions are in place (CVE-2011-1098). (bnc#677336) - The writeState function in logrotate might allow context-dependent attackers to cause a denial of service (rotation outage) via a (1) \n (newline) or (2) \ (backslash) character in a log filename, as demonstrated by a filename that is automatically constructed on the basis of a hostname or virtual machine name (CVE-2011-1155). (bnc#679662) - Fix handling of missingok option which previously was not working as expected.
    last seen2020-06-01
    modified2020-06-02
    plugin id54827
    published2011-05-26
    reporterThis script is Copyright (C) 2011-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/54827
    titleSuSE 11.1 Security Update : logrotate (SAT Patch Number 4583)
  • NASL familyMandriva Local Security Checks
    NASL idMANDRIVA_MDVSA-2011-065.NASL
    descriptionMultiple vulnerabilities were discovered and corrected in logrotate : Race condition in the createOutputFile function in logrotate.c in logrotate 3.7.9 and earlier allows local users to read log data by opening a file before the intended permissions are in place (CVE-2011-1098). The shred_file function in logrotate.c in logrotate 3.7.9 and earlier might allow context-dependent attackers to execute arbitrary commands via shell metacharacters in a log filename, as demonstrated by a filename that is automatically constructed on the basis of a hostname or virtual machine name (CVE-2011-1154). The writeState function in logrotate.c in logrotate 3.7.9 and earlier might allow context-dependent attackers to cause a denial of service (rotation outage) via a (1) \n (newline) or (2) \ (backslash) character in a log filename, as demonstrated by a filename that is automatically constructed on the basis of a hostname or virtual machine name (CVE-2011-1155). Packages for 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more: http://store.mandriva.com/product_info.php?cPath=149 products_id=490 The updated packages have been upgraded to the 3.7.9 version and patched to correct these issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id53301
    published2011-04-06
    reporterThis script is Copyright (C) 2011-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/53301
    titleMandriva Linux Security Advisory : logrotate (MDVSA-2011:065)

Redhat

advisories
bugzilla
id680798
titleCVE-2011-1098 logrotate: TOCTOU race condition by creation of new files (between opening the file and moment, final permissions have been applied) [information disclosure]
oval
OR
  • commentRed Hat Enterprise Linux must be installed
    ovaloval:com.redhat.rhba:tst:20070304026
  • AND
    • commentRed Hat Enterprise Linux 6 is installed
      ovaloval:com.redhat.rhba:tst:20111656003
    • commentlogrotate is earlier than 0:3.7.8-12.el6_0.1
      ovaloval:com.redhat.rhsa:tst:20110407001
    • commentlogrotate is signed with Red Hat redhatrelease2 key
      ovaloval:com.redhat.rhsa:tst:20110407002
rhsa
idRHSA-2011:0407
released2011-03-31
severityModerate
titleRHSA-2011:0407: logrotate security update (Moderate)
rpms
  • logrotate-0:3.7.8-12.el6_0.1
  • logrotate-debuginfo-0:3.7.8-12.el6_0.1

Seebug

bulletinFamilyexploit
descriptionCVE ID: CVE-2011-1155,CVE-2011-1154,CVE-2011-1098 logrotate程序可简化多个日志文件的管理,允许日志文件的自动循环、压缩、删除和 邮寄。 logrotate处理shred指令时存在shell命令注入漏洞,特制日志文件可造成logrotate 以运行logrotate(默认root)的用户权限执行任意命令。注意:默认没有启用shred指令。 logrotate在创建新日志文件时应用权限的方式中存在竞争条件漏洞,在一些特定配置 中,本地攻击者可利用此漏洞在logrotate应用最终权限之前打开新的日志文件,可导 致泄露敏感信息。 logrotate中存在输入验证漏洞。带有特制文件名称的日志文件可在试图再次处理该文 件时造成logrotate中断。 RedHat Red Hat Enterprise Linux Desktop 6 RedHat Red Hat Enterprise Linux HPC Node 6 RedHat Red Hat Enterprise Linux Server 6 RedHat Red Hat Enterprise Linux Workstation 6 厂商补丁: RedHat ------ RedHat已经为此发布了一个安全公告(RHSA-20110407-01)以及相应补丁: RHSA-20110407-01:Moderate: logrotate security update 链接:https://www.redhat.com/support/errata/-RHSA-20110407.html
idSSV:20437
last seen2017-11-19
modified2011-04-02
published2011-04-02
reporterRoot
titleRed Hat Enterprise Linux logrotate任意执行命令及信息泄露漏洞

References