Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 13 Jan 2017 15:00:36 +0100
From: Carlos Alberto Lopez Perez <>
Subject: Re: Nginx (Debian-based + Gentoo distros) - Root
 Privilege Escalation [CVE-2016-1247 UPDATE]

On 13/01/17 10:35, Dawid Golunski wrote:
> Attackers who have managed to replace the log file with a symlink would
> have to wait for nginx daemon to re-open the log files. 
> For this to happen nginx service needs to be restarted, or the daemon needs
> to receive a USR1 process signal. 
> However, the USR1 is sent automatically on default installations of 
> Debian-based systems through logrotate script which calls do_rotate() 
> function as can be seen in the files quoted below:
> --------[ /etc/logrotate.d/nginx ]--------
> /var/log/nginx/*.log {
> 	daily
> 	missingok
> 	rotate 52
> 	compress
> 	delaycompress
> 	notifempty
> 	create 0640 www-data adm
> 	sharedscripts
> 	prerotate
> 		if [ -d /etc/logrotate.d/httpd-prerotate ]; then \
> 			run-parts /etc/logrotate.d/httpd-prerotate; \
> 		fi \
> 	endscript
> 	postrotate
> 		invoke-rc.d nginx rotate >/dev/null 2>&1
> 	endscript
> }
> ------------------------------------------

This looks to me like an issue on the logrotate side rather than on the nginx one..

If I have:

/var/log/nginx/error.log -> /etc/

Why does logrotate "create 0640 www-data adm" over /var/log/nginx/error.log
removes and creates /etc/ ??? That is shocking!

It should do that on /var/log/nginx/error.log, by removing that symlink
and creating a new empty standard file on /var/log/nginx/error.log !!

Dont you agree??

Download attachment "signature.asc" of type "application/pgp-signature" (884 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.