Vulnerability Details : CVE-2011-1548
The default configuration of logrotate on Debian GNU/Linux uses root privileges to process files in directories that permit non-root write access, which allows local users to conduct symlink and hard link attacks by leveraging logrotate's lack of support for untrusted directories, as demonstrated by /var/log/postgresql/.
Products affected by CVE-2011-1548
- cpe:2.3:a:gentoo:logrotate:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2011-1548
0.06%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 15 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2011-1548
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
6.3
|
MEDIUM | AV:L/AC:M/Au:N/C:N/I:C/A:C |
3.4
|
9.2
|
NIST |
CWE ids for CVE-2011-1548
-
Assigned by: nvd@nist.gov (Primary)
References for CVE-2011-1548
-
http://openwall.com/lists/oss-security/2011/03/04/29
oss-security - Re: CVE Request -- logrotate -- nine issues
-
http://openwall.com/lists/oss-security/2011/03/08/5
oss-security - Re: CVE Request -- logrotate -- nine issues
-
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=606544
#606544 - postgresql-common: affected by privilege escalation vulnerability in logrotate - Debian Bug report logs
-
http://openwall.com/lists/oss-security/2011/03/05/6
oss-security - Re: CVE Request -- logrotate -- nine issues
-
http://openwall.com/lists/oss-security/2011/03/04/26
oss-security - Re: CVE Request -- logrotate -- nine issues
-
http://openwall.com/lists/oss-security/2011/03/07/11
oss-security - Re: CVE Request -- logrotate -- nine issues
-
http://openwall.com/lists/oss-security/2011/03/04/30
oss-security - Re: CVE Request -- logrotate -- nine issues
-
http://openwall.com/lists/oss-security/2011/03/04/27
oss-security - Re: CVE Request -- logrotate -- nine issues
-
http://openwall.com/lists/oss-security/2011/03/14/26
oss-security - Re: CVE Request -- logrotate -- nine issues
-
http://openwall.com/lists/oss-security/2011/03/06/3
oss-security - Re: CVE Request -- logrotate -- nine issues
-
http://www.securityfocus.com/bid/47167
logrotate Debian Linux 'var/log/postgresql' Symlink Local Privilege Escalation Vulnerability
-
http://openwall.com/lists/oss-security/2011/03/04/16
oss-security - CVE Request -- logrotate -- nine issues
-
http://openwall.com/lists/oss-security/2011/03/05/4
oss-security - Re: CVE Request -- logrotate -- nine issues
-
http://openwall.com/lists/oss-security/2011/03/04/22
oss-security - Re: CVE Request -- logrotate -- nine issues
-
http://openwall.com/lists/oss-security/2011/03/04/33
oss-security - Re: CVE Request -- logrotate -- nine issues
-
http://openwall.com/lists/oss-security/2011/03/04/18
oss-security - Re: CVE Request -- logrotate -- nine issues
-
http://openwall.com/lists/oss-security/2011/03/04/17
oss-security - Re: CVE Request -- logrotate -- nine issues
-
http://openwall.com/lists/oss-security/2011/03/04/28
oss-security - Re: CVE Request -- logrotate -- nine issues
-
http://openwall.com/lists/oss-security/2011/03/10/2
oss-security - Re: CVE Request -- logrotate -- nine issues
-
http://openwall.com/lists/oss-security/2011/03/07/6
oss-security - Re: CVE Request -- logrotate -- nine issues
-
http://openwall.com/lists/oss-security/2011/03/06/6
oss-security - Re: CVE Request -- logrotate -- nine issues
-
http://openwall.com/lists/oss-security/2011/03/10/3
oss-security - Re: CVE Request -- logrotate -- nine issues
-
http://openwall.com/lists/oss-security/2011/03/06/4
oss-security - Re: CVE Request -- logrotate -- nine issues
-
http://openwall.com/lists/oss-security/2011/03/11/3
oss-security - Re: CVE Request -- logrotate -- nine issues
-
http://openwall.com/lists/oss-security/2011/03/04/31
oss-security - Re: CVE Request -- logrotate -- nine issues
-
http://openwall.com/lists/oss-security/2011/03/04/25
oss-security - Re: CVE Request -- logrotate -- nine issues
-
http://openwall.com/lists/oss-security/2011/03/04/32
oss-security - Re: CVE Request -- logrotate -- nine issues
-
http://openwall.com/lists/oss-security/2011/03/04/24
oss-security - Re: CVE Request -- logrotate -- nine issues
-
http://openwall.com/lists/oss-security/2011/03/05/8
oss-security - Re: CVE Request -- logrotate -- nine issues
-
http://openwall.com/lists/oss-security/2011/03/06/5
oss-security - Re: CVE Request -- logrotate -- nine issues
-
http://openwall.com/lists/oss-security/2011/03/10/6
oss-security - Re: CVE Request -- logrotate -- nine issues
-
http://openwall.com/lists/oss-security/2011/03/23/11
oss-security - Re: CVE Request -- logrotate -- nine issues
-
http://openwall.com/lists/oss-security/2011/03/10/7
oss-security - Re: CVE Request -- logrotate -- nine issues
-
http://openwall.com/lists/oss-security/2011/03/11/5
oss-security - Re: CVE Request -- logrotate -- nine issues
-
http://openwall.com/lists/oss-security/2011/03/07/5
oss-security - Re: CVE Request -- logrotate -- nine issues
-
http://openwall.com/lists/oss-security/2011/03/04/19
oss-security - Re: CVE Request -- logrotate -- nine issues
Jump to