The default configuration of logrotate on Debian GNU/Linux uses root privileges to process files in directories that permit non-root write…

published 2011-03-30 15 y ago modified 2026-06-16 4 mo ago also EUVD-2011-1549

cvss: 6.3; version 2.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.4%; EPSS 0.4% chance of exploitation in 30 days, percentile 33%
public exploits: 0; none known

The default configuration of logrotate on Debian GNU/Linux uses root privileges to process files in directories that permit non-root write access, which allows local users to conduct symlink and hard link attacks by leveraging logrotate's lack of support for untrusted directories, as demonstrated by /var/log/postgresql/.

Patch / fix

distros 1

logrotate Debian 14, Debian 13, Debian 12 3.7.8-6

debian advisories DEBIAN-CVE-2011-1548

Exploit prediction

0.39% chance of exploitation in the next 30 days, higher than 33% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by	version	score	vector
NVD	2.0	6.3	AV:L/AC:M/Au:N/C:N/I:C/A:C

Classification

Weakness

CWE-264 Permissions, Privileges, and Access Controls

References

openwall.com /lists/oss-security/2011/03/04/19
mailing-list
openwall.com /lists/oss-security/2011/03/04/16
mailing-list
openwall.com /lists/oss-security/2011/03/04/25
mailing-list
openwall.com /lists/oss-security/2011/03/04/30
mailing-list
openwall.com /lists/oss-security/2011/03/04/26
mailing-list
openwall.com /lists/oss-security/2011/03/10/3
mailing-list
openwall.com /lists/oss-security/2011/03/04/28
mailing-list
openwall.com /lists/oss-security/2011/03/08/5
mailing-list
openwall.com /lists/oss-security/2011/03/07/5
mailing-list
openwall.com /lists/oss-security/2011/03/04/31
mailing-list
openwall.com /lists/oss-security/2011/03/04/17
mailing-list
openwall.com /lists/oss-security/2011/03/10/6
mailing-list
openwall.com /lists/oss-security/2011/03/06/3
mailing-list
openwall.com /lists/oss-security/2011/03/04/29
mailing-list
openwall.com /lists/oss-security/2011/03/07/6
mailing-list
openwall.com /lists/oss-security/2011/03/05/6
mailing-list
openwall.com /lists/oss-security/2011/03/05/4
mailing-list
openwall.com /lists/oss-security/2011/03/07/11
mailing-list
openwall.com /lists/oss-security/2011/03/23/11
mailing-list
openwall.com /lists/oss-security/2011/03/06/5
mailing-list
openwall.com /lists/oss-security/2011/03/04/18
mailing-list
openwall.com /lists/oss-security/2011/03/10/2
mailing-list
securityfocus.com /bid/47167
vdb-entry
openwall.com /lists/oss-security/2011/03/11/3
mailing-list
openwall.com /lists/oss-security/2011/03/10/7
mailing-list
openwall.com /lists/oss-security/2011/03/05/8
mailing-list
openwall.com /lists/oss-security/2011/03/04/22
mailing-list
openwall.com /lists/oss-security/2011/03/11/5
mailing-list
openwall.com /lists/oss-security/2011/03/04/27
mailing-list
openwall.com /lists/oss-security/2011/03/04/32
mailing-list
openwall.com /lists/oss-security/2011/03/14/26
mailing-list
openwall.com /lists/oss-security/2011/03/04/24
mailing-list
openwall.com /lists/oss-security/2011/03/06/4
mailing-list
bugs.debian.org /cgi-bin/bugreport.cgi?bug=606544
openwall.com /lists/oss-security/2011/03/06/6
mailing-list
openwall.com /lists/oss-security/2011/03/04/33
mailing-list

Sources

CVE List CVE-2011-1548
NVD CVE-2011-1548

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary