CVE-2011-1098: Race Condition
It was found that logrotate utility used insecure default permissions, when creating of new files (time-of-check, time-of-use, TOCTOU race condition). In some specific configurations, a local attacker could use this flaw to open the new file before the final permissions have been applied, leading to disclosure of sensitive information.
Other sources
Race condition in the createOutputFile function in logrotate.c in logrotate 3.7.9 and earlier allows local users to read log data by opening a file before the intended permissions are in place.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-1098?
CVE-2011-1098 has a medium severity rating due to its potential to allow local attackers to exploit a TOCTOU race condition.
How do I fix CVE-2011-1098?
To fix CVE-2011-1098, update the logrotate utility to a patched version or adjust file permissions to prevent race conditions.
What software versions are affected by CVE-2011-1098?
CVE-2011-1098 affects multiple versions of logrotate including 3.3, 3.5.9, 3.6.5, and various 3.7.x versions.
Who is impacted by CVE-2011-1098?
Users with vulnerable logrotate configurations, particularly in unsecure environments, are impacted by CVE-2011-1098.
What types of attacks can CVE-2011-1098 facilitate?
CVE-2011-1098 can facilitate local privilege escalation attacks by allowing an attacker to open new log files before permissions are properly set.