CVE-2011-1548

Publication date 30 March 2011

Last updated 24 July 2024

Ubuntu priority

Medium

Why this priority?

The default configuration of logrotate on Debian GNU/Linux uses root privileges to process files in directories that permit non-root write access, which allows local users to conduct symlink and hard link attacks by leveraging logrotate’s lack of support for untrusted directories, as demonstrated by /var/log/postgresql/.

Read the notes from the security team

Status

No maintained releases are affected by this CVE.

Package Ubuntu Release Status
logrotate 11.04 natty
Not affected
10.10 maverick
Not affected
10.04 LTS lucid
Not affected
9.10 karmic Ignored end of life
8.04 LTS hardy
Fixed 3.7.1-3ubuntu0.8.04.1
6.06 LTS dapper Ignored end of life

Notes

mdeslaur

looks like issue #9, adding RH bug upstream patch adds “su” option variable, and probably breaks backwards compatibility RH proposed patch for CVE-2011-1098 may fix it in a backwards-compatible way pretty much fixed by nofollow.patch and security-388608.patch in lucid+