REDHAT-BUG-680237: High severity LogWatch LogWatch vulnerability
A security flaw was found in the way logwatch, a log file analysis program, pre-processed log files, containing certain special characters in their names. A remote attacker could use this flaw to execute arbitrary code with the privileges of the privileged system user (root) by creating a specially-crafted log file, subsequently analyzed by the logwatch script.
Upstream bug report: [1] http://sourceforge.net/tracker/?func=detail&aid=3184223&groupid=312875&atid=1316824
Related patch: [2] http://logwatch.svn.sourceforge.net/viewvc/logwatch?view=revision&revision=26
Other references: [3] http://sourceforge.net/mailarchive/forum.php?threadname=4D604843.7040303%40mblmail.net&forumname=logwatch-devel
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-680237?
The severity of REDHAT-BUG-680237 is critical due to the potential for arbitrary code execution with root privileges.
How do I fix REDHAT-BUG-680237?
To fix REDHAT-BUG-680237, update the Logwatch package to the latest version provided by your distribution.
What versions of Logwatch are affected by REDHAT-BUG-680237?
REDHAT-BUG-680237 affects specific versions of Logwatch that process log files containing special characters.
Can REDHAT-BUG-680237 be exploited remotely?
Yes, REDHAT-BUG-680237 can be exploited remotely if an attacker creates log files with specially crafted names.
What type of attack does REDHAT-BUG-680237 enable?
REDHAT-BUG-680237 enables arbitrary code execution attacks on systems running vulnerable versions of Logwatch.