K16871 : logrotate vulnerability CVE-2011-1155

Security Advisory Description

The writeState function in logrotate.c in logrotate 3.7.9 and earlier might allow context-dependent attackers to cause a denial of service (rotation outage) via a (1) \n (newline) or (2) \ (backslash) character in a log filename, as demonstrated by a filename that is automatically constructed on the basis of a hostname or virtual machine name. (CVE-2011-1155)

Impact

This vulnerability is considered local, as it is exploitable only by a locally authenticated user. Context-dependent attackers may be able to cause a denial-of-service (DoS) (rotation outage) by way of a (1) \n (newline) or (2) \ (backslash) character in a log file name.