CVE-2011-1154: Input Validation
A shell command injection flaw was found in the way the logrotate utility handled shred configuration directive (intended to ensure the log files are not readable after their scheduled deletion). A local attacker could use this flaw to execute arbitrary system commands (if the logrotate was run under privileged system user account, root) when the logrotate utility was run on a log file, within attacker controllable directory.
Other sources
The shredfile function in logrotate.c in logrotate 3.7.9 and earlier might allow context-dependent attackers to execute arbitrary commands via shell metacharacters in a log filename, as demonstrated by a filename that is automatically constructed on the basis of a hostname or virtual machine name.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-1154?
CVE-2011-1154 is considered to have a high severity due to the potential for arbitrary command execution by a local attacker.
How do I fix CVE-2011-1154?
To fix CVE-2011-1154, update the logrotate software to a version that has patched the vulnerability.
Which versions of logrotate are affected by CVE-2011-1154?
CVE-2011-1154 affects logrotate versions 3.3 to 3.7.9, particularly from Gentoo.
Can CVE-2011-1154 be exploited remotely?
No, CVE-2011-1154 requires local access to exploit the command injection vulnerability.
What is a shell command injection vulnerability in the context of CVE-2011-1154?
A shell command injection vulnerability allows an attacker to execute arbitrary commands on the system by manipulating the input to vulnerable software.