CVE-2011-1154

logrotate < 3.7.9 - OS Command Injection via Shell Metacharacters in Log Filename

Title source: llm
STIX 2.1

Description

The shred_file function in logrotate.c in logrotate 3.7.9 and earlier might allow context-dependent attackers to execute arbitrary commands via shell metacharacters in a log filename, as demonstrated by a filename that is automatically constructed on the basis of a hostname or virtual machine name.

References (43)

Core 43
Core References
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/43955
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2011/0961
Vendor Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2011/0791
Mailing List mailing-list x_refsource_mlist
http://openwall.com/lists/oss-security/2011/03/04/19
Mailing List mailing-list x_refsource_mlist
http://openwall.com/lists/oss-security/2011/03/04/16
Mailing List mailing-list x_refsource_mlist
http://openwall.com/lists/oss-security/2011/03/04/25
Mailing List mailing-list x_refsource_mlist
http://openwall.com/lists/oss-security/2011/03/04/30
Mailing List mailing-list x_refsource_mlist
http://openwall.com/lists/oss-security/2011/03/04/26
Mailing List mailing-list x_refsource_mlist
http://openwall.com/lists/oss-security/2011/03/10/3
Mailing List mailing-list x_refsource_mlist
http://openwall.com/lists/oss-security/2011/03/04/28
Mailing List mailing-list x_refsource_mlist
http://openwall.com/lists/oss-security/2011/03/08/5
Mailing List mailing-list x_refsource_mlist
http://openwall.com/lists/oss-security/2011/03/07/5
Mailing List mailing-list x_refsource_mlist
http://openwall.com/lists/oss-security/2011/03/04/31
Mailing List mailing-list x_refsource_mlist
http://openwall.com/lists/oss-security/2011/03/04/17
Mailing List mailing-list x_refsource_mlist
http://openwall.com/lists/oss-security/2011/03/10/6
Mailing List mailing-list x_refsource_mlist
http://openwall.com/lists/oss-security/2011/03/06/3
Mailing List mailing-list x_refsource_mlist
http://openwall.com/lists/oss-security/2011/03/04/29
Mailing List mailing-list x_refsource_mlist
http://openwall.com/lists/oss-security/2011/03/07/6
Mailing List mailing-list x_refsource_mlist
http://openwall.com/lists/oss-security/2011/03/05/6
Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057845.html
Mailing List mailing-list x_refsource_mlist
http://openwall.com/lists/oss-security/2011/03/05/4
Vendor Advisory vendor-advisory x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDVSA-2011:065
Patch mailing-list x_refsource_mlist
http://openwall.com/lists/oss-security/2011/03/07/11
Mailing List mailing-list x_refsource_mlist
http://openwall.com/lists/oss-security/2011/03/23/11
Mailing List mailing-list x_refsource_mlist
http://openwall.com/lists/oss-security/2011/03/06/5
Mailing List mailing-list x_refsource_mlist
http://openwall.com/lists/oss-security/2011/03/04/18
Mailing List mailing-list x_refsource_mlist
http://openwall.com/lists/oss-security/2011/03/10/2
Vendor Advisory vendor-advisory x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2011-0407.html
Mailing List mailing-list x_refsource_mlist
http://openwall.com/lists/oss-security/2011/03/11/3
Mailing List mailing-list x_refsource_mlist
http://openwall.com/lists/oss-security/2011/03/10/7
Mailing List mailing-list x_refsource_mlist
http://openwall.com/lists/oss-security/2011/03/05/8
Mailing List mailing-list x_refsource_mlist
http://openwall.com/lists/oss-security/2011/03/04/22
Mailing List mailing-list x_refsource_mlist
http://openwall.com/lists/oss-security/2011/03/11/5
Mailing List mailing-list x_refsource_mlist
http://openwall.com/lists/oss-security/2011/03/04/27
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2011/0872
Mailing List mailing-list x_refsource_mlist
http://openwall.com/lists/oss-security/2011/03/04/32
Mailing List mailing-list x_refsource_mlist
http://openwall.com/lists/oss-security/2011/03/14/26
Mailing List mailing-list x_refsource_mlist
http://openwall.com/lists/oss-security/2011/03/04/24
Mailing List mailing-list x_refsource_mlist
http://openwall.com/lists/oss-security/2011/03/06/4
Mailing List mailing-list x_refsource_mlist
http://openwall.com/lists/oss-security/2011/03/06/6
Mailing List mailing-list x_refsource_mlist
http://openwall.com/lists/oss-security/2011/03/04/33

Scores

EPSS 0.0005
EPSS Percentile 16.1%

Details

CWE
CWE-20
Status published
Products (10)
gentoo/logrotate 3.3 r2
gentoo/logrotate 3.5.9 (2 CPE variants)
gentoo/logrotate 3.6.5 (2 CPE variants)
gentoo/logrotate 3.7
gentoo/logrotate 3.7.1 (3 CPE variants)
gentoo/logrotate 3.7.2
gentoo/logrotate 3.7.6
gentoo/logrotate 3.7.7
gentoo/logrotate 3.7.8
gentoo/logrotate < 3.7.9
Published Mar 30, 2011
Tracked Since Feb 18, 2026