oss-security - Re: CVE Request -- logrotate -- nine issues

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20110304145232.GA25390@openwall.com>
Date: Fri, 4 Mar 2011 17:52:32 +0300
From: Solar Designer <solar@...nwall.com>
To: oss-security@...ts.openwall.com
Cc: "Steven M. Christey" <coley@...us.mitre.org>,
	Stefan Fritsch <sf@...itsch.de>, Jan Kaluza <jkaluza@...hat.com>,
	Florian Zumbiehl <florz@...rz.de>, Paul Martin <pm@...ian.org>,
	Petr Uzel <petr.uzel@...e.cz>, Thomas Biege <thomas@...e.de>
Subject: Re: CVE Request -- logrotate -- nine issues

On Fri, Mar 04, 2011 at 03:08:31PM +0100, Jan Lieskovsky wrote:
>   we have been contacted by Stefan Fritsch of Debian Security Team
> about presence of nine security flaws in the logrotate utility
> (the list is provided below).

I've just skimmed over the list, and I only see one issue that I'd call
a vulnerability in logrotate, issue #8.  And we need more info on #5.

The rest, as described, appear to rely on sysadmin error and to assume
security properties that logrotate never advertised it had.  Specifically,
logrotate was never declared to be safe to use on untrusted directories,
and it was an error for a sysadmin to make such an assumption.

I don't mind logrotate being enhanced/hardened in this respect, but to
call these vulnerabilities sounds like a stretch.  Also, even if
logrotate is hardened, it should not be declared to be safe to use on
untrusted directories.  It'd be better to explicitly state that it is
not, to avoid this sort of confusion.

> 5) Issue #5: logrotate: Information disclosure by performing email
>              notifications
...
> 8) Issue #8: logrotate: TOCTOU race condition by creation of new files 
> (between
>              opening the file and moment, final permissions have been 
>              applied)
>              [information disclosure]

Alexander

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.