CVE-2011-1098

Published: Mar 30, 2011Modified: Apr 29, 2026

1.9

Vector

AV:L/AC:M/Au:N/C:P/I:N/A:N

Exploitability: 3.4 / Impact: 2.9

Source: NVD

Description

Race condition in the createOutputFile function in logrotate.c in logrotate 3.7.9 and earlier allows local users to read log data by opening a file before the intended permissions are in place.

Affected (14)

Products: Gentoo: Logrotate

Gentoo

1 product

Logrotate

Configuration A

14 vulnerable

Vulnerable Software	Affected Versions
Gentoo Logrotate	Up to 3.7.9
Gentoo Logrotate	Version 3.3 r2
Gentoo Logrotate	Version 3.5.9
Gentoo Logrotate	Version 3.5.9 r1
Gentoo Logrotate	Version 3.6.5
Gentoo Logrotate	Version 3.6.5 r1
Gentoo Logrotate	Version 3.7.1
Gentoo Logrotate	Version 3.7.1 r1
Gentoo Logrotate	Version 3.7.1 r2
Gentoo Logrotate	Version 3.7.2
Gentoo Logrotate	Version 3.7.6
Gentoo Logrotate	Version 3.7.7
Gentoo Logrotate	Version 3.7.8
Gentoo Logrotate	Version 3.7

Related CWEs

CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.

References (86)

http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057845.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056992.html

Source: secalert@redhat.com

Patch

http://openwall.com/lists/oss-security/2011/03/04/16

Source: secalert@redhat.com

Patch

http://openwall.com/lists/oss-security/2011/03/04/17

Source: secalert@redhat.com

http://openwall.com/lists/oss-security/2011/03/04/18

Source: secalert@redhat.com

http://openwall.com/lists/oss-security/2011/03/04/19

Source: secalert@redhat.com

http://openwall.com/lists/oss-security/2011/03/04/22

Source: secalert@redhat.com

http://openwall.com/lists/oss-security/2011/03/04/24

Source: secalert@redhat.com

http://openwall.com/lists/oss-security/2011/03/04/25

Source: secalert@redhat.com

http://openwall.com/lists/oss-security/2011/03/04/26

Source: secalert@redhat.com

http://openwall.com/lists/oss-security/2011/03/04/27

Source: secalert@redhat.com

http://openwall.com/lists/oss-security/2011/03/04/28

Source: secalert@redhat.com

http://openwall.com/lists/oss-security/2011/03/04/29

Source: secalert@redhat.com

http://openwall.com/lists/oss-security/2011/03/04/30

Source: secalert@redhat.com

http://openwall.com/lists/oss-security/2011/03/04/31

Source: secalert@redhat.com

http://openwall.com/lists/oss-security/2011/03/04/32

Source: secalert@redhat.com

http://openwall.com/lists/oss-security/2011/03/04/33

Source: secalert@redhat.com

http://openwall.com/lists/oss-security/2011/03/05/4

Source: secalert@redhat.com

http://openwall.com/lists/oss-security/2011/03/05/6

Source: secalert@redhat.com

http://openwall.com/lists/oss-security/2011/03/05/8

Source: secalert@redhat.com

http://openwall.com/lists/oss-security/2011/03/06/3

Source: secalert@redhat.com

http://openwall.com/lists/oss-security/2011/03/06/4

Source: secalert@redhat.com

http://openwall.com/lists/oss-security/2011/03/06/5

Source: secalert@redhat.com

http://openwall.com/lists/oss-security/2011/03/06/6

Source: secalert@redhat.com

http://openwall.com/lists/oss-security/2011/03/07/11

Source: secalert@redhat.com

Patch

http://openwall.com/lists/oss-security/2011/03/07/5

Source: secalert@redhat.com

http://openwall.com/lists/oss-security/2011/03/07/6

Source: secalert@redhat.com

http://openwall.com/lists/oss-security/2011/03/08/5

Source: secalert@redhat.com

http://openwall.com/lists/oss-security/2011/03/10/2

Source: secalert@redhat.com

http://openwall.com/lists/oss-security/2011/03/10/3

Source: secalert@redhat.com

http://openwall.com/lists/oss-security/2011/03/10/6

Source: secalert@redhat.com

http://openwall.com/lists/oss-security/2011/03/10/7

Source: secalert@redhat.com

http://openwall.com/lists/oss-security/2011/03/11/3

Source: secalert@redhat.com

http://openwall.com/lists/oss-security/2011/03/11/5

Source: secalert@redhat.com

http://openwall.com/lists/oss-security/2011/03/14/26

Source: secalert@redhat.com

http://openwall.com/lists/oss-security/2011/03/23/11

Source: secalert@redhat.com

http://secunia.com/advisories/43955

Source: secalert@redhat.com

http://www.mandriva.com/security/advisories?name=MDVSA-2011:065

Source: secalert@redhat.com

http://www.redhat.com/support/errata/RHSA-2011-0407.html

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2011/0791

Source: secalert@redhat.com

Vendor Advisory

http://www.vupen.com/english/advisories/2011/0872

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2011/0961

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=680798

Source: secalert@redhat.com

Patch

http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057845.html