CVE-2019-11675 - The groonga-httpd package 6.1.5-1 for Debian sets the /var/log/groonga ownership to the groonga account, which might let local users obtain root access because of unsafe interaction with logrotate

Back Back to CVE browser

HIGH

The groonga-httpd package 6.1.5-1 for Debian sets the /var/log/groonga ownership to the groonga account, which might let local users obtain root access because of unsafe interaction with logrotate

Published May 2, 2019

7.0

HIGH

CVSS 3.0

EPSS 0.23%

Description

The groonga-httpd package 6.1.5-1 for Debian sets the /var/log/groonga ownership to the groonga account, which might let local users obtain root access because of unsafe interaction with logrotate. For example, an attacker can exploit a race condition to insert a symlink from /var/log/groonga/httpd to /etc/bash_completion.d. NOTE: this is an issue in the Debian packaging of the Groonga HTTP server.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-362

Race Condition

References (2)

https://bugs.debian.org/928304
x_refsource_MISCMailing ListMitigationThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-3345
Advisory

Link	Providers	Tags
https://bugs.debian.org/928304		x_refsource_MISCMailing ListMitigationThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-3345		Advisory