Race condition in the createOutputFile function in logrotate.c in logrotate 3.7.9 and earlier allows local users to read log data by opening a file before the intended permissions are in place.

The remote NewStart CGSL host, running version MAIN 6.02, has logrotate packages installed that are affected by multiple vulnerabilities:

  - Race condition in the createOutputFile function in logrotate.c in logrotate 3.7.9 and earlier allows local     users to read log data by opening a file before the intended permissions are in place. (CVE-2011-1098)

  - The shred_file function in logrotate.c in logrotate 3.7.9 and earlier might allow context-dependent     attackers to execute arbitrary commands via shell metacharacters in a log filename, as demonstrated by a     filename that is automatically constructed on the basis of a hostname or virtual machine name.
    (CVE-2011-1154)

  - The writeState function in logrotate.c in logrotate 3.7.9 and earlier might allow context-dependent     attackers to cause a denial of service (rotation outage) via a (1) \n (newline) or (2) \ (backslash)     character in a log filename, as demonstrated by a filename that is automatically constructed on the basis     of a hostname or virtual machine name. (CVE-2011-1155)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has logrotate packages installed that are affected by multiple vulnerabilities:

  - Race condition in the createOutputFile function in logrotate.c in logrotate 3.7.9 and earlier allows local     users to read log data by opening a file before the intended permissions are in place. (CVE-2011-1098)

  - The shred_file function in logrotate.c in logrotate 3.7.9 and earlier might allow context-dependent     attackers to execute arbitrary commands via shell metacharacters in a log filename, as demonstrated by a     filename that is automatically constructed on the basis of a hostname or virtual machine name.
    (CVE-2011-1154)

  - The writeState function in logrotate.c in logrotate 3.7.9 and earlier might allow context-dependent     attackers to cause a denial of service (rotation outage) via a (1) \n (newline) or (2) \ (backslash)     character in a log filename, as demonstrated by a filename that is automatically constructed on the basis     of a hostname or virtual machine name. (CVE-2011-1155)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has logrotate packages installed that are affected by multiple vulnerabilities:

  - Race condition in the createOutputFile function in logrotate.c in logrotate 3.7.9 and earlier allows local     users to read log data by opening a file before the intended permissions are in place. (CVE-2011-1098)

  - The shred_file function in logrotate.c in logrotate 3.7.9 and earlier might allow context-dependent     attackers to execute arbitrary commands via shell metacharacters in a log filename, as demonstrated by a     filename that is automatically constructed on the basis of a hostname or virtual machine name.
    (CVE-2011-1154)

  - The writeState function in logrotate.c in logrotate 3.7.9 and earlier might allow context-dependent     attackers to cause a denial of service (rotation outage) via a (1) \n (newline) or (2) \ (backslash)     character in a log filename, as demonstrated by a filename that is automatically constructed on the basis     of a hostname or virtual machine name. (CVE-2011-1155)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for logrotate provides the following fixes :

dbg114-logrotate-4580 logrotate-4580 new_updateinfo The shred_file function in logrotate might allow context-dependent attackers to execute arbitrary commands via shell metacharacters in a log filename, as demonstrated by a filename that is automatically constructed on the basis of a hostname or virtual machine name (CVE-2011-1154) (bnc#679661)

dbg114-logrotate-4580 logrotate-4580 new_updateinfo Race condition in the createOutputFile function in logrotate allows local users to read log data by opening a file before the intended permissions are in place (CVE-2011-1098) (bnc#677336)

dbg114-logrotate-4580 logrotate-4580 new_updateinfo The writeState function in logrotate might allow context-dependent attackers to cause a denial of service (rotation outage) via a (1) n (newline) or (2) (backslash) character in a log filename, as demonstrated by a filename that is automatically constructed on the basis of a hostname or virtual machine name (CVE-2011-1155) (bnc#679662)

This update for logrotate provides the following fixes :

  - The shred_file function in logrotate might allow     context-dependent attackers to execute arbitrary     commands via shell metacharacters in a log filename, as     demonstrated by a filename that is automatically     constructed on the basis of a hostname or virtual     machine name (CVE-2011-1154) (bnc#679661)

  - Race condition in the createOutputFile function in     logrotate allows local users to read log data by opening     a file before the intended permissions are in place     (CVE-2011-1098) (bnc#677336)

  - The writeState function in logrotate might allow     context-dependent attackers to cause a denial of service     (rotation outage) via a (1) \n (newline) or (2) \     (backslash) character in a log filename, as demonstrated     by a filename that is automatically constructed on the     basis of a hostname or virtual machine name     (CVE-2011-1155) (bnc#679662)

From Red Hat Security Advisory 2011:0407 :

An updated logrotate package that fixes multiple security issues is now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The logrotate utility simplifies the administration of multiple log files, allowing the automatic rotation, compression, removal, and mailing of log files.

A shell command injection flaw was found in the way logrotate handled the shred directive. A specially crafted log file could cause logrotate to execute arbitrary commands with the privileges of the user running logrotate (root, by default). Note: The shred directive is not enabled by default. (CVE-2011-1154)

A race condition flaw was found in the way logrotate applied permissions when creating new log files. In some specific configurations, a local attacker could use this flaw to open new log files before logrotate applies the final permissions, possibly leading to the disclosure of sensitive information. (CVE-2011-1098)

An input sanitization flaw was found in logrotate. A log file with a specially crafted file name could cause logrotate to abort when attempting to process that file a subsequent time. (CVE-2011-1155)

All logrotate users should upgrade to this updated package, which contains backported patches to resolve these issues.

A shell command injection flaw was found in the way logrotate handled the shred directive. A specially crafted log file could cause logrotate to execute arbitrary commands with the privileges of the user running logrotate (root, by default). Note: The shred directive is not enabled by default. (CVE-2011-1154)

A race condition flaw was found in the way logrotate applied permissions when creating new log files. In some specific configurations, a local attacker could use this flaw to open new log files before logrotate applies the final permissions, possibly leading to the disclosure of sensitive information. (CVE-2011-1098)

An input sanitization flaw was found in logrotate. A log file with a specially crafted file name could cause logrotate to abort when attempting to process that file a subsequent time. (CVE-2011-1155)

The remote host is affected by the vulnerability described in GLSA-201206-36 (logrotate: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in logrotate. Please       review the CVE identifiers referenced below for details.
  Impact :

    A local attacker could use this flaw to truncate arbitrary system file,       to change file owner or mode on arbitrary system files, to conduct       symlink attacks and send arbitrary system files, to execute arbitrary       system commands, to cause abort in subsequent logrotate runs, to disclose       sensitive information, to execute arbitrary code or cause a Denial of       Service condition.
  Workaround :

    There is no known workaround at this time.

This update for logrotate provides the following fixes :

  - Race condition in the createOutputFile function in     logrotate allows local users to read log data by opening     a file before the intended permissions are in place.
    (bnc#677336 / CVE-2011-1098)

  - The writeState function in logrotate might allow     context-dependent attackers to cause a denial of service     (rotation outage) via a (1) \n (newline) or (2) \     (backslash) character in a log filename, as demonstrated     by a filename that is automatically constructed on the     basis of a hostname or virtual machine name. (bnc#679662     / CVE-2011-1155)

It was discovered that logrotate incorrectly handled the creation of new log files. Local users could possibly read log files if they were opened before permissions were in place. This issue only affected Ubuntu 8.04 LTS. (CVE-2011-1098)

It was discovered that logrotate incorrectly handled certain log file names when used with the shred option. Local attackers able to create log files with specially crafted filenames could use this issue to execute arbitrary code. This issue only affected Ubuntu 10.04 LTS, 10.10, and 11.04. (CVE-2011-1154)

It was discovered that logrotate incorrectly handled certain malformed log filenames. Local attackers able to create log files with specially crafted filenames could use this issue to cause logrotate to stop processing log files, resulting in a denial of service.
(CVE-2011-1155)

It was discovered that logrotate incorrectly handled symlinks and hard links when processing log files. A local attacker having write access to a log file directory could use this issue to overwrite or read arbitrary files. This issue only affected Ubuntu 8.04 LTS.
(CVE-2011-1548).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for logrotate provides the following fixes :

  - Race condition in the createOutputFile function in     logrotate allows local users to read log data by opening     a file before the intended permissions are in place     (CVE-2011-1098). (bnc#677336)

  - The writeState function in logrotate might allow     context-dependent attackers to cause a denial of service     (rotation outage) via a (1) \n (newline) or (2) \     (backslash) character in a log filename, as demonstrated     by a filename that is automatically constructed on the     basis of a hostname or virtual machine name     (CVE-2011-1155). (bnc#679662)

  - In addition, the missingok option has been improved

This update for logrotate provides the following fixes :

  - The shred_file function in logrotate might allow     context-dependent attackers to execute arbitrary     commands via shell metacharacters in a log filename, as     demonstrated by a filename that is automatically     constructed on the basis of a hostname or virtual     machine name (CVE-2011-1154). (bnc#679661)

  - Race condition in the createOutputFile function in     logrotate allows local users to read log data by opening     a file before the intended permissions are in place     (CVE-2011-1098). (bnc#677336)

  - The writeState function in logrotate might allow     context-dependent attackers to cause a denial of service     (rotation outage) via a (1) \n (newline) or (2) \     (backslash) character in a log filename, as demonstrated     by a filename that is automatically constructed on the     basis of a hostname or virtual machine name     (CVE-2011-1155). (bnc#679662)

  - Fix handling of missingok option which previously was     not working as expected.

Fixes CVE-2011-1154, CVE-2011-1155 and CVE-2011-1098.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilities were discovered and corrected in logrotate :

Race condition in the createOutputFile function in logrotate.c in logrotate 3.7.9 and earlier allows local users to read log data by opening a file before the intended permissions are in place (CVE-2011-1098).

The shred_file function in logrotate.c in logrotate 3.7.9 and earlier might allow context-dependent attackers to execute arbitrary commands via shell metacharacters in a log filename, as demonstrated by a filename that is automatically constructed on the basis of a hostname or virtual machine name (CVE-2011-1154).

The writeState function in logrotate.c in logrotate 3.7.9 and earlier might allow context-dependent attackers to cause a denial of service (rotation outage) via a (1) \n (newline) or (2) \ (backslash) character in a log filename, as demonstrated by a filename that is automatically constructed on the basis of a hostname or virtual machine name (CVE-2011-1155).

Packages for 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149 products_id=490

The updated packages have been upgraded to the 3.7.9 version and patched to correct these issues.

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2011:0407 advisory.

  - logrotate: TOCTOU race condition by creation of new files (between opening the file and moment, final     permissions have been applied) [information disclosure] (CVE-2011-1098)

  - logrotate: Shell command injection by using the shred configuration directive (CVE-2011-1154)

  - logrotate: DoS due improper escaping of file names within 'write state' action (CVE-2011-1155)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
167473	NewStart CGSL MAIN 6.02 : logrotate Multiple Vulnerabilities (NS-SA-2022-0095)	Nessus	NewStart CGSL Local Security Checks	medium
160771	NewStart CGSL CORE 5.05 / MAIN 5.05 : logrotate Multiple Vulnerabilities (NS-SA-2022-0037)	Nessus	NewStart CGSL Local Security Checks	medium
154524	NewStart CGSL CORE 5.04 / MAIN 5.04 : logrotate Multiple Vulnerabilities (NS-SA-2021-0108)	Nessus	NewStart CGSL Local Security Checks	medium
85917	F5 Networks BIG-IP : logrotate vulnerability (SOL16869)	Nessus	F5 Networks Local Security Checks	low
75942	openSUSE Security Update : logrotate (openSUSE-SU-2011:0536-1)	Nessus	SuSE Local Security Checks	medium
75638	openSUSE Security Update : logrotate (openSUSE-SU-2011:0536-1)	Nessus	SuSE Local Security Checks	medium
68243	Oracle Linux 6 : logrotate (ELSA-2011-0407)	Nessus	Oracle Linux Local Security Checks	medium
61004	Scientific Linux Security Update : logrotate on SL6.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
59709	GLSA-201206-36 : logrotate: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
57224	SuSE 10 Security Update : logrotate (ZYPP Patch Number 7533)	Nessus	SuSE Local Security Checks	low
55648	Ubuntu 8.04 LTS / 10.04 LTS / 10.10 / 11.04 : logrotate vulnerabilities (USN-1172-1)	Nessus	Ubuntu Local Security Checks	medium
54829	SuSE 10 Security Update : logrotate (ZYPP Patch Number 7534)	Nessus	SuSE Local Security Checks	low
54827	SuSE 11.1 Security Update : logrotate (SAT Patch Number 4583)	Nessus	SuSE Local Security Checks	medium
53363	Fedora 14 : logrotate-3.7.9-2.fc14 (2011-3739)	Nessus	Fedora Local Security Checks	medium
53301	Mandriva Linux Security Advisory : logrotate (MDVSA-2011:065)	Nessus	Mandriva Local Security Checks	medium
53246	RHEL 6 : logrotate (RHSA-2011:0407)	Nessus	Red Hat Local Security Checks	medium
53199	Fedora 15 : logrotate-3.7.9-8.fc15 (2011-3758)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2011-1098

medium

Tenable Plugins

medium

medium

medium

low

medium

medium

medium

medium

medium

low

medium

low

medium

medium

medium

medium

medium