CVE-2011-1155

2011-03-3000:00:00

ubuntu.com

CVSS2

1.9

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:L/AC:M/Au:N/C:N/I:N/A:P

EPSS

0.001

Percentile

30.2%

JSON

The writeState function in logrotate.c in logrotate 3.7.9 and earlier might
allow context-dependent attackers to cause a denial of service (rotation
outage) via a (1) \n (newline) or (2) \ (backslash) character in a log
filename, as demonstrated by a filename that is automatically constructed
on the basis of a hostname or virtual machine name.

Bugs

<https://bugzilla.redhat.com/show_bug.cgi?id=680797>

Notes

Author	Note
mdeslaur	issue #7

OSVersionArchitecturePackageVersionFilename
ubuntu8.04noarchlogrotate< 3.7.1-3ubuntu0.8.04.1UNKNOWN
ubuntu10.04noarchlogrotate< 3.7.8-4ubuntu2.2UNKNOWN
ubuntu10.10noarchlogrotate< 3.7.8-6ubuntu1.1UNKNOWN
ubuntu11.04noarchlogrotate< 3.7.8-6ubuntu3.1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	8.04	noarch	logrotate	< 3.7.1-3ubuntu0.8.04.1	UNKNOWN
ubuntu	10.04	noarch	logrotate	< 3.7.8-4ubuntu2.2	UNKNOWN
ubuntu	10.10	noarch	logrotate	< 3.7.8-6ubuntu1.1	UNKNOWN
ubuntu	11.04	noarch	logrotate	< 3.7.8-6ubuntu3.1	UNKNOWN