Synopsis: Moderate: logrotate security update
Issue Date: 2011-03-31
CVE Numbers: CVE-2011-1154
CVE-2011-1155
—
The logrotate utility simplifies the administration of multiple log files,
allowing the automatic rotation, compression, removal, and mailing of log
files.
A shell command injection flaw was found in the way logrotate handled the
shred directive. A specially-crafted log file could cause logrotate to
execute arbitrary commands with the privileges of the user running
logrotate (root, by default). Note: The shred directive is not enabled by
default. (CVE-2011-1154)
A race condition flaw was found in the way logrotate applied permissions
when creating new log files. In some specific configurations, a local
attacker could use this flaw to open new log files before logrotate applies
the final permissions, possibly leading to the disclosure of sensitive
information. (CVE-2011-1098)
An input sanitization flaw was found in logrotate. A log file with a
specially-crafted file name could cause logrotate to abort when attempting
to process that file a subsequent time. (CVE-2011-1155)
All logrotate users should upgrade to this updated package, which contains
backported patches to resolve these issues.
—
SL6
x86_64
logrotate-3.7.8-12.el6_0.1.x86_64.rpm
i386
logrotate-3.7.8-12.el6_0.1.i686.rpm
– Scientific Linux Development Team
