CVE-2011-1548

logrotate - Local Privilege Escalation

Title source: llm

Description

The default configuration of logrotate on Debian GNU/Linux uses root privileges to process files in directories that permit non-root write access, which allows local users to conduct symlink and hard link attacks by leveraging logrotate's lack of support for untrusted directories, as demonstrated by /var/log/postgresql/.

References (36)

[Issue Tracking] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=606544

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/47167

[Mailing List] http://openwall.com/lists/oss-security/2011/03/04/16

[Mailing List] http://openwall.com/lists/oss-security/2011/03/04/17

[Mailing List] http://openwall.com/lists/oss-security/2011/03/04/18

[Mailing List] http://openwall.com/lists/oss-security/2011/03/04/19

[Mailing List] http://openwall.com/lists/oss-security/2011/03/04/22

[Mailing List] http://openwall.com/lists/oss-security/2011/03/04/24

[Mailing List] http://openwall.com/lists/oss-security/2011/03/04/25

[Mailing List] http://openwall.com/lists/oss-security/2011/03/04/26

[Mailing List] http://openwall.com/lists/oss-security/2011/03/04/27

[Mailing List] http://openwall.com/lists/oss-security/2011/03/04/28

[Mailing List] http://openwall.com/lists/oss-security/2011/03/04/29

[Mailing List] http://openwall.com/lists/oss-security/2011/03/04/30

[Mailing List] http://openwall.com/lists/oss-security/2011/03/04/31

[Mailing List] http://openwall.com/lists/oss-security/2011/03/04/32

[Mailing List] http://openwall.com/lists/oss-security/2011/03/04/33

[Mailing List] http://openwall.com/lists/oss-security/2011/03/05/4

[Mailing List] http://openwall.com/lists/oss-security/2011/03/05/6

[Mailing List] http://openwall.com/lists/oss-security/2011/03/05/8

... and 16 more

Scores

EPSS 0.0006

EPSS Percentile 18.1%

Classification

CWE

CWE-264

Status draft

Affected Products (1)

gentoo/logrotate

Timeline

Published Mar 30, 2011

Tracked Since Feb 18, 2026