Lucene search

Ubuntu.comUB:CVE-2011-1098

HistoryMar 30, 2011 - 12:00 a.m.

CVE-2011-1098

2011-03-3000:00:00

ubuntu.com

CVSS2

1.9

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:M/Au:N/C:P/I:N/A:N

EPSS

0.001

Percentile

17.0%

JSON

Race condition in the createOutputFile function in logrotate.c in logrotate
3.7.9 and earlier allows local users to read log data by opening a file
before the intended permissions are in place.

Bugs

<https://bugzilla.redhat.com/show_bug.cgi?id=680798>

Notes

Author	Note
mdeslaur	this is issue #8 this seems to have been addressed in debian/ubuntu by the create-388608.patch patch. hardy doesn’t have them (in (3.7.8-4))

OSVersionArchitecturePackageVersionFilename
ubuntu8.04noarchlogrotate< 3.7.1-3ubuntu0.8.04.1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	8.04	noarch	logrotate	< 3.7.1-3ubuntu0.8.04.1	UNKNOWN

References

openwall.com/lists/oss-security/2011/03/04/16

launchpad.net/bugs/cve/CVE-2011-1098

nvd.nist.gov/vuln/detail/CVE-2011-1098

security-tracker.debian.org/tracker/CVE-2011-1098

ubuntu.com/security/notices/USN-1172-1

www.cve.org/CVERecord?id=CVE-2011-1098

CVSS2

1.9

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:M/Au:N/C:P/I:N/A:N

EPSS

0.001

Percentile

17.0%

JSON

Related for UB:CVE-2011-1098