Displaying 1 result from an estimated 1 matches for "sizea".
Did you mean:
size
2005 Oct 29
1
Bug#336265: logrotate detection, possible attack not checked by logcheck
Package: logcheck
Version: 1.2.41
Problem: Logcheck try to detect if log file have been rotate or not by file size way.
Possible attack:
- current log file (sizeA)
- run logcheck, (logcheck/logtail put inode in offsetfile), offset=sizeA
- [attacker run attack 1]
- run logrotate
- [attacker run attack 2]
- run logcheck may don't detect the rotation and don't check the log for attack 1 duration.
attack 1 : The real attack, this attack log will not be...