[linux-security] local root exploit in logwatch

[Martin Siegert <siegert@sfu.ca>]

Topic
=====
local root exploit in logwatch

Problem Description
===================
LogWatch is a customizable log analysis system. Versions of LogWatch 2.1.1
and earlier have a vulnerability due to a race condition during the creation
of a temporary directory.  This vulnerability can allow a local user to gain
root privileges.  An additional race condition was found in versions of
LogWatch 2.5 and earlier.

Affected Systems
================
systems that use logwatch with versions < 2.6

Solution
========
upgrade to logwatch 2.6 or later.

RedHat 7.2
----------
rpm -Fvh logwatch-2.6-1.noarch.rpm