CVE-2011-1154

The shred_file function in logrotate.c in logrotate 3.7.9 and earlier might allow context-dependent attackers to execute arbitrary commands via shell metacharacters in a log filename, as demonstrated by a filename that is automatically constructed on the basis of a hostname or virtual machine name.
Severity
UNKNOWN
AV:L/AC:M/Au:N/C:C/I:C/A:C
Atk. Vector
LOCAL
Atk. Complexity
MEDIUM
Base Score
CVSS 3.x
EPSS Score
Percentile: 32%
VendorProductVersion
gentoologrotate
𝑥
≤ 3.7.9
gentoologrotate
3.3
gentoologrotate
3.5.9
gentoologrotate
3.5.9
gentoologrotate
3.6.5
gentoologrotate
3.6.5
gentoologrotate
3.7
gentoologrotate
3.7.1
gentoologrotate
3.7.1
gentoologrotate
3.7.1
gentoologrotate
3.7.2
gentoologrotate
3.7.6
gentoologrotate
3.7.7
gentoologrotate
3.7.8
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
logrotate
bullseye
3.18.0-2+deb11u2
fixed
squeeze
no-dsa
bookworm
3.21.0-1
fixed
sid
3.22.0-1
fixed
trixie
3.22.0-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
logrotate
natty
Fixed 3.7.8-6ubuntu3.1
released
maverick
Fixed 3.7.8-6ubuntu1.1
released
lucid
Fixed 3.7.8-4ubuntu2.2
released
karmic
ignored
hardy
not-affected
dapper
not-affected
Common Weakness Enumeration
References
http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057845.html
http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056992.html
http://openwall.com/lists/oss-security/2011/03/04/16
http://openwall.com/lists/oss-security/2011/03/04/17
http://openwall.com/lists/oss-security/2011/03/04/18
http://openwall.com/lists/oss-security/2011/03/04/19
http://openwall.com/lists/oss-security/2011/03/04/22
http://openwall.com/lists/oss-security/2011/03/04/24
http://openwall.com/lists/oss-security/2011/03/04/25
http://openwall.com/lists/oss-security/2011/03/04/26
http://openwall.com/lists/oss-security/2011/03/04/27
http://openwall.com/lists/oss-security/2011/03/04/28
http://openwall.com/lists/oss-security/2011/03/04/29
http://openwall.com/lists/oss-security/2011/03/04/30
http://openwall.com/lists/oss-security/2011/03/04/31
http://openwall.com/lists/oss-security/2011/03/04/32
http://openwall.com/lists/oss-security/2011/03/04/33
http://openwall.com/lists/oss-security/2011/03/05/4
http://openwall.com/lists/oss-security/2011/03/05/6
http://openwall.com/lists/oss-security/2011/03/05/8
http://openwall.com/lists/oss-security/2011/03/06/3
http://openwall.com/lists/oss-security/2011/03/06/4
http://openwall.com/lists/oss-security/2011/03/06/5
http://openwall.com/lists/oss-security/2011/03/06/6
http://openwall.com/lists/oss-security/2011/03/07/11
http://openwall.com/lists/oss-security/2011/03/07/5
http://openwall.com/lists/oss-security/2011/03/07/6
http://openwall.com/lists/oss-security/2011/03/08/5
http://openwall.com/lists/oss-security/2011/03/10/2
http://openwall.com/lists/oss-security/2011/03/10/3
http://openwall.com/lists/oss-security/2011/03/10/6
http://openwall.com/lists/oss-security/2011/03/10/7
http://openwall.com/lists/oss-security/2011/03/11/3
http://openwall.com/lists/oss-security/2011/03/11/5
http://openwall.com/lists/oss-security/2011/03/14/26
http://openwall.com/lists/oss-security/2011/03/23/11
http://secunia.com/advisories/43955
http://www.mandriva.com/security/advisories?name=MDVSA-2011:065
http://www.redhat.com/support/errata/RHSA-2011-0407.html
http://www.vupen.com/english/advisories/2011/0791
http://www.vupen.com/english/advisories/2011/0872
http://www.vupen.com/english/advisories/2011/0961
https://bugzilla.redhat.com/show_bug.cgi?id=680796
http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057845.html
http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056992.html
http://openwall.com/lists/oss-security/2011/03/04/16
http://openwall.com/lists/oss-security/2011/03/04/17
http://openwall.com/lists/oss-security/2011/03/04/18
http://openwall.com/lists/oss-security/2011/03/04/19
http://openwall.com/lists/oss-security/2011/03/04/22
http://openwall.com/lists/oss-security/2011/03/04/24
http://openwall.com/lists/oss-security/2011/03/04/25
http://openwall.com/lists/oss-security/2011/03/04/26
http://openwall.com/lists/oss-security/2011/03/04/27
http://openwall.com/lists/oss-security/2011/03/04/28
http://openwall.com/lists/oss-security/2011/03/04/29
http://openwall.com/lists/oss-security/2011/03/04/30
http://openwall.com/lists/oss-security/2011/03/04/31
http://openwall.com/lists/oss-security/2011/03/04/32
http://openwall.com/lists/oss-security/2011/03/04/33
http://openwall.com/lists/oss-security/2011/03/05/4
http://openwall.com/lists/oss-security/2011/03/05/6
http://openwall.com/lists/oss-security/2011/03/05/8
http://openwall.com/lists/oss-security/2011/03/06/3
http://openwall.com/lists/oss-security/2011/03/06/4
http://openwall.com/lists/oss-security/2011/03/06/5
http://openwall.com/lists/oss-security/2011/03/06/6
http://openwall.com/lists/oss-security/2011/03/07/11
http://openwall.com/lists/oss-security/2011/03/07/5
http://openwall.com/lists/oss-security/2011/03/07/6
http://openwall.com/lists/oss-security/2011/03/08/5
http://openwall.com/lists/oss-security/2011/03/10/2
http://openwall.com/lists/oss-security/2011/03/10/3
http://openwall.com/lists/oss-security/2011/03/10/6
http://openwall.com/lists/oss-security/2011/03/10/7
http://openwall.com/lists/oss-security/2011/03/11/3
http://openwall.com/lists/oss-security/2011/03/11/5
http://openwall.com/lists/oss-security/2011/03/14/26
http://openwall.com/lists/oss-security/2011/03/23/11
http://secunia.com/advisories/43955
http://www.mandriva.com/security/advisories?name=MDVSA-2011:065
http://www.redhat.com/support/errata/RHSA-2011-0407.html
http://www.vupen.com/english/advisories/2011/0791
http://www.vupen.com/english/advisories/2011/0872
http://www.vupen.com/english/advisories/2011/0961
https://bugzilla.redhat.com/show_bug.cgi?id=680796