Bug 680237 (CVE-2011-1018)

Summary: CVE-2011-1018 logwatch: Privilege escalation due improper sanitization of special characters in log file names
Product: [Other] Security Response Reporter: Jan Lieskovsky <jlieskov>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: bressers, mjc, rphipps+bugzredhat, rvokal, security-response-team, vkrizan
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2015-07-29 13:58:15 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 680253, 680301, 680302, 680303, 680304, 833937    
Bug Blocks:    

Description Jan Lieskovsky 2011-02-24 18:52:23 UTC
A security flaw was found in the way logwatch, a log file
analysis program, pre-processed log files, containing certain
special characters in their names. A remote attacker could
use this flaw to execute arbitrary code with the privileges
of the privileged system user (root) by creating a 
specially-crafted log file, subsequently analyzed by the
logwatch script.

Upstream bug report:
[1] http://sourceforge.net/tracker/?func=detail&aid=3184223&group_id=312875&atid=1316824

Related patch:
[2] http://logwatch.svn.sourceforge.net/viewvc/logwatch?view=revision&revision=26

Other references:
[3] http://sourceforge.net/mailarchive/forum.php?thread_name=4D604843.7040303%40mblmail.net&forum_name=logwatch-devel

Comment 1 Jan Lieskovsky 2011-02-24 18:54:42 UTC
This issue affects the versions of the logwatch package, as shipped
with Red Hat Enterprise Linux 5, and 6.

--

This issue affects the versions of the logwatch package, as shipped
with Fedora release of 13 and 14.

Comment 3 Jan Lieskovsky 2011-02-24 19:53:24 UTC
CVE Request:
[4] http://www.openwall.com/lists/oss-security/2011/02/24/13

Comment 4 Jan Lieskovsky 2011-02-24 19:54:56 UTC
Created logwatch tracking bugs for this issue

Affects: fedora-all [bug 680253]

Comment 5 Josh Bressers 2011-02-24 23:44:28 UTC
RHEL4 is not affected. The way that version of logwatch cats log files together offloads the shell expansion to the shell. It's not terribly safe looking in code, but it works.

You end up with things like `cat /var/log/httpd/* > output` The wildcard is passed to the shell unexpanded. From what I see, it's not getting expanded when logwatch is run.

Comment 6 Josh Bressers 2011-02-25 00:38:46 UTC
The upstream patch appears to work. Outside using system, it appears to do it in a fairly safe manner now. I don't like using system() for this sort of thing, but that's likely outside the scope of this fix.

Comment 8 Josh Bressers 2011-02-25 00:43:05 UTC
Created logwatch tracking bugs for this issue

Affects: fedora-all [bug 680253]

Comment 10 Richard Phipps 2011-03-02 18:46:06 UTC
Should we expect updates for Red Hat Enterprise Linux 5, and 6 ?

Comment 11 Josh Bressers 2011-03-02 19:18:01 UTC
Updates are in progress. Once they've passed all of our internal testing, we will release updates.

Thanks.

Comment 12 errata-xmlrpc 2011-03-07 21:01:46 UTC
This issue has been addressed in following products:

  Red Hat Enterprise Linux 6
  Red Hat Enterprise Linux 5

Via RHSA-2011:0324 https://rhn.redhat.com/errata/RHSA-2011-0324.html