CVE-2015-3243
Publication date 25 July 2017
Last updated 24 July 2024
Ubuntu priority
rsyslog uses weak permissions for generating log files, which allows local users to obtain sensitive information by reading files in /var/log/cron.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| rsyslog | ||
| 14.04 LTS trusty |
Not affected
|
|
Notes
sbeattie
redhat was configured to create /var/log/cron mode 644 in ubuntu, cron goes to /var/log/syslog, which is 640 with group access being granted to the 'adm' group.
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score |
5.5 · Medium
|
| Attack vector | Local |
| Attack complexity | Low |
| Privileges required | Low |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | High |
| Integrity impact | None |
| Availability impact | None |
| Vector | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |