Bug 680787 - logrotate: TOCTOU race condition by creating the compressed or copied log file (information disclosure)
Summary: logrotate: TOCTOU race condition by creating the compressed or copied log fil...
Keywords:
Status: CLOSED NOTABUG
Alias: None
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2011-02-27 19:12 UTC by Jan Lieskovsky
Modified: 2019-09-29 12:43 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2011-03-11 06:29:21 UTC


Attachments (Terms of Use)

Description Jan Lieskovsky 2011-02-27 19:12:48 UTC
A file access race condition (time-of-check, time-of-use, TOCTOU
race condition) was found in the way logrotate determines the
permissions to newly created files when compression or copying of a
log file has been requested. If the logrotate utility was run on a log
file contained within an attacker controllable directory, a local
attacker could use this flaw to trick the logrotate utility into
creating the compressed or copied file with user selected permissions,
potentially leading to disclosure of sensitive information.

Comment 4 Jan Lieskovsky 2011-03-03 09:20:50 UTC
Further clarified flaw information from Stefan Fritsch of Debian Security Team:
===============================================================================

Both compressLogFile() and copyTruncate() are vulnerable to this
issue. Instead of using the permissions passed in sb, both functions
should call fstat() on the opened file.


Note You need to log in before you can comment on or make changes to this bug.