Re: CVE Request -- logrotate -- nine issues

[Solar Designer <solar () openwall com>]

On Thu, Mar 10, 2011 at 10:32:43PM +0100, Florian Zumbiehl wrote:
> > > | However, I think that still #6 (shell injection) and #7 (logrotate
> > > | DoS with strange characters in file names) should be considered
> > > | vulnerabilities in logrotate: ...
[...]
> I was thinking more in the direction of an existing config that includes
> a wildcard and software that uses user input to construct file names
> that would be matched by that wildcard. An example of such software
> would be samba, which tends to create per-client-host log files named
> after those hosts. I don't have a clue whether samba could be made to
> include any shell meta characters (does it even do reverse lookups for
> that?), but I guess you get the idea.

This makes sense, and I agree that it's a reason for logrotate to treat
log filenames as potentially untrusted input.  It's probably also a
reason to get CVE ids assigned.

Thank you for explaining the attack vector here!

Alexander