oss-sec mailing list archives
Re: CVE Request -- logrotate -- nine issues
From: Florian Zumbiehl <florz () florz de>
Date: Fri, 4 Mar 2011 16:14:00 +0100
Hi,
The rest, as described, appear to rely on sysadmin error and to assume security properties that logrotate never advertised it had. Specifically, logrotate was never declared to be safe to use on untrusted directories, and it was an error for a sysadmin to make such an assumption. I don't mind logrotate being enhanced/hardened in this respect, but to call these vulnerabilities sounds like a stretch. Also, even if logrotate is hardened, it should not be declared to be safe to use on untrusted directories. It'd be better to explicitly state that it is not, to avoid this sort of confusion.
In which scenarios exactly logrotate is supposed to be safe to use is mostly undefined. However, it is currently a common setup (as in: what distributions do out of the box) to have a daily logrotate cron job run as root that rotates the logs of all the services and to have log directories owned by service users (so they can create missing log files, for example). In such setups, the service user can elevate its privileges to root or corrupt root-owned files using the various bugs. Florian
Current thread:
- CVE Request -- logrotate -- nine issues Jan Lieskovsky (Mar 04)
- Re: CVE Request -- logrotate -- nine issues Solar Designer (Mar 04)
- Re: CVE Request -- logrotate -- nine issues Florian Zumbiehl (Mar 04)
- Re: CVE Request -- logrotate -- nine issues Solar Designer (Mar 04)
- Re: CVE Request -- logrotate -- nine issues Steven M. Christey (Mar 04)
- Re: CVE Request -- logrotate -- nine issues Solar Designer (Mar 04)
- Re: CVE Request -- logrotate -- nine issues Steven M. Christey (Mar 04)
- Re: CVE Request -- logrotate -- nine issues Dan Rosenberg (Mar 04)
- Re: CVE Request -- logrotate -- nine issues Steve Grubb (Mar 07)
- Re: CVE Request -- logrotate -- nine issues Josh Bressers (Mar 07)
- Re: CVE Request -- logrotate -- nine issues Florian Zumbiehl (Mar 04)
- Re: CVE Request -- logrotate -- nine issues Solar Designer (Mar 04)
- Re: CVE Request -- logrotate -- nine issues Florian Zumbiehl (Mar 04)
- Re: CVE Request -- logrotate -- nine issues Solar Designer (Mar 05)
- Re: CVE Request -- logrotate -- nine issues Florian Zumbiehl (Mar 06)