Bug 680237 (CVE-2011-1018) - CVE-2011-1018 logwatch: Privilege escalation due improper sanitization of special characters in log file names
Summary: CVE-2011-1018 logwatch: Privilege escalation due improper sanitization of spe...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2011-1018
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: public=20110216,reported=20110224,sou...
Depends On: 680253 680301 680302 680303 680304 833937
Blocks:
TreeView+ depends on / blocked
 
Reported: 2011-02-24 18:52 UTC by Jan Lieskovsky
Modified: 2019-06-08 18:45 UTC (History)
6 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2015-07-29 13:58:15 UTC


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2011:0324 normal SHIPPED_LIVE Important: logwatch security update 2011-03-07 21:01:38 UTC

Description Jan Lieskovsky 2011-02-24 18:52:23 UTC
A security flaw was found in the way logwatch, a log file
analysis program, pre-processed log files, containing certain
special characters in their names. A remote attacker could
use this flaw to execute arbitrary code with the privileges
of the privileged system user (root) by creating a 
specially-crafted log file, subsequently analyzed by the
logwatch script.

Upstream bug report:
[1] http://sourceforge.net/tracker/?func=detail&aid=3184223&group_id=312875&atid=1316824

Related patch:
[2] http://logwatch.svn.sourceforge.net/viewvc/logwatch?view=revision&revision=26

Other references:
[3] http://sourceforge.net/mailarchive/forum.php?thread_name=4D604843.7040303%40mblmail.net&forum_name=logwatch-devel

Comment 1 Jan Lieskovsky 2011-02-24 18:54:42 UTC
This issue affects the versions of the logwatch package, as shipped
with Red Hat Enterprise Linux 5, and 6.

--

This issue affects the versions of the logwatch package, as shipped
with Fedora release of 13 and 14.

Comment 3 Jan Lieskovsky 2011-02-24 19:53:24 UTC
CVE Request:
[4] http://www.openwall.com/lists/oss-security/2011/02/24/13

Comment 4 Jan Lieskovsky 2011-02-24 19:54:56 UTC
Created logwatch tracking bugs for this issue

Affects: fedora-all [bug 680253]

Comment 5 Josh Bressers 2011-02-24 23:44:28 UTC
RHEL4 is not affected. The way that version of logwatch cats log files together offloads the shell expansion to the shell. It's not terribly safe looking in code, but it works.

You end up with things like `cat /var/log/httpd/* > output` The wildcard is passed to the shell unexpanded. From what I see, it's not getting expanded when logwatch is run.

Comment 6 Josh Bressers 2011-02-25 00:38:46 UTC
The upstream patch appears to work. Outside using system, it appears to do it in a fairly safe manner now. I don't like using system() for this sort of thing, but that's likely outside the scope of this fix.

Comment 8 Josh Bressers 2011-02-25 00:43:05 UTC
Created logwatch tracking bugs for this issue

Affects: fedora-all [bug 680253]

Comment 10 Richard Phipps 2011-03-02 18:46:06 UTC
Should we expect updates for Red Hat Enterprise Linux 5, and 6 ?

Comment 11 Josh Bressers 2011-03-02 19:18:01 UTC
Updates are in progress. Once they've passed all of our internal testing, we will release updates.

Thanks.

Comment 12 errata-xmlrpc 2011-03-07 21:01:46 UTC
This issue has been addressed in following products:

  Red Hat Enterprise Linux 6
  Red Hat Enterprise Linux 5

Via RHSA-2011:0324 https://rhn.redhat.com/errata/RHSA-2011-0324.html


Note You need to log in before you can comment on or make changes to this bug.