CVE-2011-1098: gentoo logrotate Race Condition

CVSS: 1.9v2.0LowModified

AliasesDEBIAN-CVE-2011-1098

Published 30-03-2011Last modified 06-08-2024

Vulnerability summary

CVE-2011-1098 is a low (CVSS 1.9) Race Condition vulnerability in gentoo logrotate. EPSS estimates a 0.28% chance of exploitation in the next 30 days, higher than 19.3% of scored vulnerabilities.

Overall risk

8/100

0100

Minimal · default modelHow is this calculated?

CVSS score

1.9/10

010

Low · v2.0 (NVD)

EPSS score

0.28%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 2 · Related 1

OPENSUSE-SU-2024:10231-1 RHSA-2011:0407

Timeline

30-03-2011
PublishedVulnerability first disclosed.
06-08-2024
Last modifiedVulnerability information updated.

Description

Race condition in the createOutputFile function in logrotate.c in logrotate 3.7.9 and earlier allows local users to read log data by opening a file before the intended permissions are in place.

CVSS metrics

1 score · 1 source · 1 version

v2.01.9

EPSS trend

Probability

0.28%

Chance of exploitation in the next 30 days

Percentile

19%

Versus all other CVEs

30-day change

0.00 pp

From 0.28% on 19-09-2026

19-09-202619-10-2026

EPSS score

0.28%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-362Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Affected systems

Debian1 product

logrotate< 3.8.0-1

Gentoo1 product

logrotate≤ 3.7.9 | 3.3:r2 | 3.5.9 | 3.5.9:r1 | 3.6.5 | 3.6.5:r1 | 3.7 | 3.7.1 | 3.7.1:r1 | 3.7.1:r2 | 3.7.2 | 3.7.6 | 3.7.7 | 3.7.8

2 vendors · 2 products

References

44 links

openwall.com/lists/oss-security/2011/03/04/19Mailing ListX Refsource MLIST
openwall.com/lists/oss-security/2011/03/04/16Mailing ListX Refsource MLISTPatch
openwall.com/lists/oss-security/2011/03/04/25Mailing ListX Refsource MLIST
openwall.com/lists/oss-security/2011/03/04/30Mailing ListX Refsource MLIST
openwall.com/lists/oss-security/2011/03/04/26Mailing ListX Refsource MLIST
openwall.com/lists/oss-security/2011/03/10/3Mailing ListX Refsource MLIST
openwall.com/lists/oss-security/2011/03/04/28Mailing ListX Refsource MLIST
openwall.com/lists/oss-security/2011/03/08/5Mailing ListX Refsource MLIST
secunia.com/advisories/43955Third Party AdvisoryX Refsource SECUNIA
openwall.com/lists/oss-security/2011/03/07/5Mailing ListX Refsource MLIST

Show all 44 references

openwall.com/lists/oss-security/2011/03/04/31Mailing ListX Refsource MLIST
www.vupen.com/english/advisories/2011/0961VDB EntryX Refsource VUPEN
openwall.com/lists/oss-security/2011/03/04/17Mailing ListX Refsource MLIST
openwall.com/lists/oss-security/2011/03/10/6Mailing ListX Refsource MLIST
openwall.com/lists/oss-security/2011/03/06/3Mailing ListX Refsource MLIST
openwall.com/lists/oss-security/2011/03/04/29Mailing ListX Refsource MLIST
openwall.com/lists/oss-security/2011/03/07/6Mailing ListX Refsource MLIST
openwall.com/lists/oss-security/2011/03/05/6Mailing ListX Refsource MLIST
lists.fedoraproject.org/pipermail/package-announce/2011-April/057845.htmlVendor AdvisoryX Refsource FEDORA
openwall.com/lists/oss-security/2011/03/05/4Mailing ListX Refsource MLIST
www.vupen.com/english/advisories/2011/0791VDB EntryX Refsource VUPENVendor Advisory
www.mandriva.com/security/advisories?name=MDVSA-2011:065Vendor AdvisoryX Refsource MANDRIVA
openwall.com/lists/oss-security/2011/03/07/11Mailing ListX Refsource MLISTPatch
openwall.com/lists/oss-security/2011/03/23/11Mailing ListX Refsource MLIST
openwall.com/lists/oss-security/2011/03/06/5Mailing ListX Refsource MLIST
bugzilla.redhat.com/show_bug.cgi?id=680798X Refsource CONFIRMPatch
openwall.com/lists/oss-security/2011/03/04/18Mailing ListX Refsource MLIST
lists.fedoraproject.org/pipermail/package-announce/2011-March/056992.htmlVendor AdvisoryX Refsource FEDORAPatch
openwall.com/lists/oss-security/2011/03/10/2Mailing ListX Refsource MLIST
www.redhat.com/support/errata/RHSA-2011-0407.htmlVendor AdvisoryX Refsource REDHAT
openwall.com/lists/oss-security/2011/03/11/3Mailing ListX Refsource MLIST
openwall.com/lists/oss-security/2011/03/10/7Mailing ListX Refsource MLIST
openwall.com/lists/oss-security/2011/03/05/8Mailing ListX Refsource MLIST
openwall.com/lists/oss-security/2011/03/04/22Mailing ListX Refsource MLIST
openwall.com/lists/oss-security/2011/03/11/5Mailing ListX Refsource MLIST
openwall.com/lists/oss-security/2011/03/04/27Mailing ListX Refsource MLIST
www.vupen.com/english/advisories/2011/0872VDB EntryX Refsource VUPEN
openwall.com/lists/oss-security/2011/03/04/32Mailing ListX Refsource MLIST
openwall.com/lists/oss-security/2011/03/14/26Mailing ListX Refsource MLIST
openwall.com/lists/oss-security/2011/03/04/24Mailing ListX Refsource MLIST
openwall.com/lists/oss-security/2011/03/06/4Mailing ListX Refsource MLIST
openwall.com/lists/oss-security/2011/03/06/6Mailing ListX Refsource MLIST
openwall.com/lists/oss-security/2011/03/04/33Mailing ListX Refsource MLIST
security-tracker.debian.org/tracker/CVE-2011-1098Advisory

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities