A vulnerability in Logwatch might allow remote attackers to execute arbitrary code.

Announced

2012-03-28

Revised

2012-03-28

Access

remote

Bugs

#356387

Advisory

https://security.gentoo.org/glsa/201203-20

Affected packages

Package	Arch	Vulnerable	Unaffected
sys-apps/logwatch	*	< 7.4.0	>= 7.4.0

Background

Logwatch analyzes and reports on system logs.

Description

logwatch.pl does not properly sanitize log filenames against shell metacharacters before passing them to the "system()" function.

Impact

A remote attacker could pass a specially crafted log filename to Logwatch, possibly resulting in execution of arbitrary code with root privileges or a Denial of Service condition.

Workaround

There is no known workaround at this time.

Resolution

All Logwatch users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=sys-apps/logwatch-7.4.0"

References

• CVE-2011-1018