← Back to branch summary

~ubuntu-security/ubuntu-cve-tracker/master

« back to all changes in this revision

Viewing changes to retired/CVE-2011-1550

  • Committer: Steve Beattie
  • Date: 2019-02-19 06:18:27 UTC
  • Revision ID: sbeattie@ubuntu.com-20190219061827-oh57fzcfc1u9dlfk
The ubuntu-cve-tracker project has been converted to git.

Please use 'git clone https://git.launchpad.net/ubuntu-cve-tracker' to
get the converted tree.

Show diffs side-by-side

added added

removed removed

Lines of Context:
retired/CVE-2011-1550
1
 
Candidate: CVE-2011-1550
2
 
PublicDate: 2011-03-30
3
 
References:
4
 
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1550
5
 
 http://openwall.com/lists/oss-security/2011/03/04/16
6
 
Description:
7
 
 The default configuration of logrotate on SUSE openSUSE Factory uses root
8
 
 privileges to process files in directories that permit non-root write
9
 
 access, which allows local users to conduct symlink and hard link attacks
10
 
 by leveraging logrotate's lack of support for untrusted directories, as
11
 
 demonstrated by directories for the (1) cobbler, (2) inn, (3)
12
 
 safte-monitor, and (4) uucp packages.
13
 
Ubuntu-Description:
14
 
Notes:
15
 
 mdeslaur> SUSE-specific CVE (see CVE-2011-1548 for Debian)
16
 
Bugs:
17
 
Priority: medium
18
 
Discovered-by:
19
 
Assigned-to:
20
 
 
21
 
Patches_logrotate:
22
 
upstream_logrotate: needs-triage
23
 
dapper_logrotate: not-affected
24
 
hardy_logrotate: not-affected
25
 
karmic_logrotate: not-affected
26
 
lucid_logrotate: not-affected
27
 
maverick_logrotate: not-affected
28
 
devel_logrotate: not-affected