// For flags

CVE-2011-1018

Logwatch Log File - Special Characters Privilege Escalation

Severity Score

9.8
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

logwatch.pl in Logwatch 7.3.6 allows remote attackers to execute arbitrary commands via shell metacharacters in a log file name, as demonstrated via a crafted username to a Samba server.

logwatch.pl en Logwatch v7.3.6 permite a atacantes remotos ejecutar comandos arbitrarios vía metacaracteres shell en un nombre de archivo de registro, como se demostró a través de un nombre de usuario manipulado en un servidor Samba.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Complete
Integrity
Complete
Availability
Complete
Attack Vector
Adjacent
Attack Complexity
Medium
Authentication
None
Confidentiality
Complete
Integrity
Complete
Availability
Complete
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2011-02-14 CVE Reserved
  • 2011-02-24 First Exploit
  • 2011-02-25 CVE Published
  • 2024-08-06 CVE Updated
  • 2025-04-01 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-20: Improper Input Validation
  • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CAPEC
References (25)
URL Tag Source
http://secunia.com/advisories/43356 Third Party Advisory
http://secunia.com/advisories/43622 Third Party Advisory
http://secunia.com/advisories/43644 Third Party Advisory
http://secunia.com/advisories/43734 Third Party Advisory
http://sourceforge.net/mailarchive/forum.php?thread_name=4D604843.7040303%40mblmail.net&forum_name=logwatch-devel Mailing List
http://www.securityfocus.com/bid/46554 Vdb Entry
http://www.securitytracker.com/id?1025165 Vdb Entry
http://www.vupen.com/english/advisories/2011/0533 Vdb Entry
http://www.vupen.com/english/advisories/2011/0581 Vdb Entry
http://www.vupen.com/english/advisories/2011/0596 Vdb Entry
URL Date SRC
https://www.exploit-db.com/exploits/35386 2011-02-24
URL Date SRC
http://logwatch.svn.sourceforge.net/viewvc/logwatch/scripts/logwatch.pl?r1=3&r2=26&pathrev=26 2023-02-13
http://sourceforge.net/tracker/?func=detail&aid=3184223&group_id=312875&atid=1316824 2023-02-13
http://www.openwall.com/lists/oss-security/2011/02/24/13 2023-02-13
http://www.openwall.com/lists/oss-security/2011/02/24/15 2023-02-13
https://bugzilla.redhat.com/show_bug.cgi?id=680237 2011-03-07
URL Date SRC
http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055579.html 2023-02-13
http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055585.html 2023-02-13
http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055617.html 2023-02-13
http://lists.opensuse.org/opensuse-security-announce/2011-04/msg00000.html 2023-02-13
http://secunia.com/advisories/43495 2023-02-13
http://www.debian.org/security/2011/dsa-2182 2023-02-13
http://www.redhat.com/support/errata/RHSA-2011-0324.html 2023-02-13
http://www.ubuntu.com/usn/USN-1078-1 2023-02-13
https://access.redhat.com/security/cve/CVE-2011-1018 2011-03-07
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Logwatch
Search vendor "Logwatch"
 Logwatch
Search vendor "Logwatch" for product "Logwatch"
 7.3.6
Search vendor "Logwatch" for product "Logwatch" and version "7.3.6"
-
Affected