CVE-2011-1154

Published: Mar 30, 2011Modified: Apr 29, 2026

6.9

Vector

AV:L/AC:M/Au:N/C:C/I:C/A:C

Exploitability: 3.4 / Impact: 10.0

Source: NVD

Description

The shred_file function in logrotate.c in logrotate 3.7.9 and earlier might allow context-dependent attackers to execute arbitrary commands via shell metacharacters in a log filename, as demonstrated by a filename that is automatically constructed on the basis of a hostname or virtual machine name.

Affected (14)

Products: Gentoo: Logrotate

Gentoo

1 product

Logrotate

Configuration A

14 vulnerable

Vulnerable Software	Affected Versions
Gentoo Logrotate	Up to 3.7.9
Gentoo Logrotate	Version 3.3 r2
Gentoo Logrotate	Version 3.5.9
Gentoo Logrotate	Version 3.5.9 r1
Gentoo Logrotate	Version 3.6.5
Gentoo Logrotate	Version 3.6.5 r1
Gentoo Logrotate	Version 3.7.1
Gentoo Logrotate	Version 3.7.1 r1
Gentoo Logrotate	Version 3.7.1 r2
Gentoo Logrotate	Version 3.7.2
Gentoo Logrotate	Version 3.7.6
Gentoo Logrotate	Version 3.7.7
Gentoo Logrotate	Version 3.7.8
Gentoo Logrotate	Version 3.7

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (86)

http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057845.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056992.html

Source: secalert@redhat.com

Patch

http://openwall.com/lists/oss-security/2011/03/04/16

Source: secalert@redhat.com

http://openwall.com/lists/oss-security/2011/03/04/17

Source: secalert@redhat.com

http://openwall.com/lists/oss-security/2011/03/04/18

Source: secalert@redhat.com

http://openwall.com/lists/oss-security/2011/03/04/19

Source: secalert@redhat.com

http://openwall.com/lists/oss-security/2011/03/04/22

Source: secalert@redhat.com

http://openwall.com/lists/oss-security/2011/03/04/24

Source: secalert@redhat.com

http://openwall.com/lists/oss-security/2011/03/04/25

Source: secalert@redhat.com

http://openwall.com/lists/oss-security/2011/03/04/26

Source: secalert@redhat.com

http://openwall.com/lists/oss-security/2011/03/04/27

Source: secalert@redhat.com

http://openwall.com/lists/oss-security/2011/03/04/28

Source: secalert@redhat.com

http://openwall.com/lists/oss-security/2011/03/04/29

Source: secalert@redhat.com

http://openwall.com/lists/oss-security/2011/03/04/30

Source: secalert@redhat.com

http://openwall.com/lists/oss-security/2011/03/04/31

Source: secalert@redhat.com

http://openwall.com/lists/oss-security/2011/03/04/32

Source: secalert@redhat.com

http://openwall.com/lists/oss-security/2011/03/04/33

Source: secalert@redhat.com

http://openwall.com/lists/oss-security/2011/03/05/4

Source: secalert@redhat.com

http://openwall.com/lists/oss-security/2011/03/05/6

Source: secalert@redhat.com

http://openwall.com/lists/oss-security/2011/03/05/8

Source: secalert@redhat.com

http://openwall.com/lists/oss-security/2011/03/06/3

Source: secalert@redhat.com

http://openwall.com/lists/oss-security/2011/03/06/4

Source: secalert@redhat.com

http://openwall.com/lists/oss-security/2011/03/06/5

Source: secalert@redhat.com

http://openwall.com/lists/oss-security/2011/03/06/6

Source: secalert@redhat.com

http://openwall.com/lists/oss-security/2011/03/07/11

Source: secalert@redhat.com

Patch

http://openwall.com/lists/oss-security/2011/03/07/5

Source: secalert@redhat.com

http://openwall.com/lists/oss-security/2011/03/07/6

Source: secalert@redhat.com

http://openwall.com/lists/oss-security/2011/03/08/5

Source: secalert@redhat.com

http://openwall.com/lists/oss-security/2011/03/10/2

Source: secalert@redhat.com

http://openwall.com/lists/oss-security/2011/03/10/3

Source: secalert@redhat.com

http://openwall.com/lists/oss-security/2011/03/10/6

Source: secalert@redhat.com

http://openwall.com/lists/oss-security/2011/03/10/7

Source: secalert@redhat.com

http://openwall.com/lists/oss-security/2011/03/11/3

Source: secalert@redhat.com

http://openwall.com/lists/oss-security/2011/03/11/5

Source: secalert@redhat.com

http://openwall.com/lists/oss-security/2011/03/14/26

Source: secalert@redhat.com

http://openwall.com/lists/oss-security/2011/03/23/11

Source: secalert@redhat.com

http://secunia.com/advisories/43955

Source: secalert@redhat.com

http://www.mandriva.com/security/advisories?name=MDVSA-2011:065

Source: secalert@redhat.com

http://www.redhat.com/support/errata/RHSA-2011-0407.html

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2011/0791

Source: secalert@redhat.com

Vendor Advisory

http://www.vupen.com/english/advisories/2011/0872

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2011/0961

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=680796

Source: secalert@redhat.com

Patch

http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057845.html