CVE-2011-1549: Medium severity logrotate vulnerability
The default configuration of logrotate on Gentoo Linux uses root privileges to process files in directories that permit non-root write access, which allows local users to conduct symlink and hard link attacks by leveraging logrotate's lack of support for untrusted directories, as demonstrated by directories under /var/log/ for packages.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2011-1549?
CVE-2011-1549 has a medium severity rating due to its exploitation potential by local users.
How do I fix CVE-2011-1549?
To fix CVE-2011-1549, modify the logrotate configuration to restrict access to untrusted directories or run logrotate with appropriate permissions.
Who is affected by CVE-2011-1549?
CVE-2011-1549 primarily affects users of Gentoo Linux using the default logrotate configuration.
What kind of attacks can be executed using CVE-2011-1549?
CVE-2011-1549 allows local users to perform symlink and hard link attacks due to the misconfiguration of logrotate.
Is CVE-2011-1549 a remote or local vulnerability?
CVE-2011-1549 is a local vulnerability, allowing exploitation by users with access to the affected system.