CVE-2011-1018: Input Validation
A security flaw was found in the way logwatch, a log file analysis program, pre-processed log files, containing certain special characters in their names. A remote attacker could use this flaw to execute arbitrary code with the privileges of the privileged system user (root) by creating a specially-crafted log file, subsequently analyzed by the logwatch script.
Upstream bug report: [1] http://sourceforge.net/tracker/?func=detail&aid=3184223&groupid=312875&atid=1316824
Related patch: [2] http://logwatch.svn.sourceforge.net/viewvc/logwatch?view=revision&revision=26
Other references: [3] http://sourceforge.net/mailarchive/forum.php?threadname=4D604843.7040303%40mblmail.net&forumname=logwatch-devel
Other sources
logwatch.pl in Logwatch 7.3.6 allows remote attackers to execute arbitrary commands via shell metacharacters in a log file name, as demonstrated via a crafted username to a Samba server.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-1018?
CVE-2011-1018 has been classified as a critical vulnerability due to its potential to allow remote code execution with root privileges.
How do I fix CVE-2011-1018?
To fix CVE-2011-1018, upgrade Logwatch to version 7.4 or later, where the vulnerability has been patched.
What software versions are affected by CVE-2011-1018?
CVE-2011-1018 specifically affects Logwatch version 7.3.6.
Can CVE-2011-1018 be exploited remotely?
Yes, CVE-2011-1018 can be exploited remotely by an attacker who creates specially crafted log file names.
What are the potential consequences of CVE-2011-1018?
The potential consequences of CVE-2011-1018 include arbitrary code execution on the affected system, which could lead to full system compromise.