This service will be undergoing maintenance at 00:00 UTC, 2016-08-01. It is expected to last about 1 hours
Bug 680237 - (CVE-2011-1018) CVE-2011-1018 logwatch: Privilege escalation due improper sanitization of special characters in log file names
CVE-2011-1018 logwatch: Privilege escalation due improper sanitization of spe...
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
high Severity high
: ---
: ---
Assigned To: Red Hat Product Security
public=20110216,reported=20110224,sou...
: Security
Depends On: 680253 680301 680302 680303 680304 833937
Blocks:
  Show dependency treegraph
 
Reported: 2011-02-24 13:52 EST by Jan Lieskovsky
Modified: 2015-11-24 09:36 EST (History)
6 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2015-07-29 09:58:15 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:


Attachments (Terms of Use)

  None (edit)
Description Jan Lieskovsky 2011-02-24 13:52:23 EST
A security flaw was found in the way logwatch, a log file
analysis program, pre-processed log files, containing certain
special characters in their names. A remote attacker could
use this flaw to execute arbitrary code with the privileges
of the privileged system user (root) by creating a 
specially-crafted log file, subsequently analyzed by the
logwatch script.

Upstream bug report:
[1] http://sourceforge.net/tracker/?func=detail&aid=3184223&group_id=312875&atid=1316824

Related patch:
[2] http://logwatch.svn.sourceforge.net/viewvc/logwatch?view=revision&revision=26

Other references:
[3] http://sourceforge.net/mailarchive/forum.php?thread_name=4D604843.7040303%40mblmail.net&forum_name=logwatch-devel
Comment 1 Jan Lieskovsky 2011-02-24 13:54:42 EST
This issue affects the versions of the logwatch package, as shipped
with Red Hat Enterprise Linux 5, and 6.

--

This issue affects the versions of the logwatch package, as shipped
with Fedora release of 13 and 14.
Comment 3 Jan Lieskovsky 2011-02-24 14:53:24 EST
CVE Request:
[4] http://www.openwall.com/lists/oss-security/2011/02/24/13
Comment 4 Jan Lieskovsky 2011-02-24 14:54:56 EST
Created logwatch tracking bugs for this issue

Affects: fedora-all [bug 680253]
Comment 5 Josh Bressers 2011-02-24 18:44:28 EST
RHEL4 is not affected. The way that version of logwatch cats log files together offloads the shell expansion to the shell. It's not terribly safe looking in code, but it works.

You end up with things like `cat /var/log/httpd/* > output` The wildcard is passed to the shell unexpanded. From what I see, it's not getting expanded when logwatch is run.
Comment 6 Josh Bressers 2011-02-24 19:38:46 EST
The upstream patch appears to work. Outside using system, it appears to do it in a fairly safe manner now. I don't like using system() for this sort of thing, but that's likely outside the scope of this fix.
Comment 8 Josh Bressers 2011-02-24 19:43:05 EST
Created logwatch tracking bugs for this issue

Affects: fedora-all [bug 680253]
Comment 10 Richard Phipps 2011-03-02 13:46:06 EST
Should we expect updates for Red Hat Enterprise Linux 5, and 6 ?
Comment 11 Josh Bressers 2011-03-02 14:18:01 EST
Updates are in progress. Once they've passed all of our internal testing, we will release updates.

Thanks.
Comment 12 errata-xmlrpc 2011-03-07 16:01:46 EST
This issue has been addressed in following products:

  Red Hat Enterprise Linux 6
  Red Hat Enterprise Linux 5

Via RHSA-2011:0324 https://rhn.redhat.com/errata/RHSA-2011-0324.html

Note You need to log in before you can comment on or make changes to this bug.