Bug 680787

Summary: logrotate: TOCTOU race condition by creating the compressed or copied log file (information disclosure)
Product: [Other] Security Response Reporter: Jan Lieskovsky <jlieskov>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED NOTABUG QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: jkaluza, petr.uzel, sf, tsmetana
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2011-03-11 06:29:21 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Jan Lieskovsky 2011-02-27 19:12:48 UTC 
A file access race condition (time-of-check, time-of-use, TOCTOU
race condition) was found in the way logrotate determines the
permissions to newly created files when compression or copying of a
log file has been requested. If the logrotate utility was run on a log
file contained within an attacker controllable directory, a local
attacker could use this flaw to trick the logrotate utility into
creating the compressed or copied file with user selected permissions,
potentially leading to disclosure of sensitive information.
Comment 4 Jan Lieskovsky 2011-03-03 09:20:50 UTC 
Further clarified flaw information from Stefan Fritsch of Debian Security Team:
===============================================================================

Both compressLogFile() and copyTruncate() are vulnerable to this
issue. Instead of using the permissions passed in sb, both functions
should call fstat() on the opened file.