CVE-2011-1018 Command injection in n/a

Critical 10.0 Published 25 Feb 2011 Updated 6 Aug 2024

Remote attackers can execute arbitrary commands on Logwatch servers by injecting shell metacharacters into log file names, such as via crafted Samba usernames.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2011-1018?

CVE-2011-1018 is a critical command injection vulnerability in n/a, published on 25 Feb 2011. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

logwatch.pl in Logwatch 7.3.6 allows remote attackers to execute arbitrary commands via shell metacharacters in a log file name, as demonstrated via a crafted username to a Samba server.

Weakness: CWE-20

Which versions are affected by CVE-2011-1018?

It affects 1 product.

Linux distribution packages (6)

`logwatch` Red Hat:enterprise_linux:5::server	All versions	`0:7.3-9.el5_6`
`logwatch` Red Hat:enterprise_linux:6::client	All versions	`0:7.3.6-49.el6`
`logwatch` Red Hat:enterprise_linux:6::computenode	All versions	`0:7.3.6-49.el6`
`logwatch` Red Hat:enterprise_linux:6::server	All versions	`0:7.3.6-49.el6`
`logwatch` Red Hat:enterprise_linux:6::workstation	All versions	`0:7.3.6-49.el6`
`logwatch` openSUSE:Tumbleweed	All versions	`7.4.3-1.4`

Products include Logwatch Logwatch.

How do I fix CVE-2011-1018?

Apply the vendor's patch.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2011-1018 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2011-1018 exists.

Public exploit code: 1 Exploit-DB entry.

Sources

Also known as DEBIAN-CVE-2011-1018, DSA-2182-1, GHSA-g657-whx2-ph73, RHSA-2011:0324, openSUSE-SU-2024:10097-1.