CVE-2011-1549

Publication date 30 March 2011

Last updated 24 July 2024

Ubuntu priority

Medium

Why this priority?

The default configuration of logrotate on Gentoo Linux uses root privileges to process files in directories that permit non-root write access, which allows local users to conduct symlink and hard link attacks by leveraging logrotate's lack of support for untrusted directories, as demonstrated by directories under /var/log/ for packages.

Read the notes from the security team

Status

Package Ubuntu Release Status
logrotate 10.10 maverick
Not affected
10.04 LTS lucid
Not affected
9.10 karmic
Not affected
8.04 LTS hardy
Not affected
6.06 LTS dapper
Not affected

Notes

mdeslaur

gentoo-specific CVE (see CVE-2011-1548 for Debian)