SUSE openSUSE Factory assigns ownership of the /var/log/cobbler/ directory tree to the web-service user account, which might allow local users to gain privileges by leveraging access to this account during root filesystem operations by the Cobbler daemon.

References

• https://nvd.nist.gov/vuln/detail/CVE-2011-1551
• https://exchange.xforce.ibmcloud.com/vulnerabilities/66487
• http://openwall.com/lists/oss-security/2011/03/23/11