CVE-2011-1154
Published Mar 30, 2011
Last updated 14 years ago
Overview
- Description
- The shred_file function in logrotate.c in logrotate 3.7.9 and earlier might allow context-dependent attackers to execute arbitrary commands via shell metacharacters in a log filename, as demonstrated by a filename that is automatically constructed on the basis of a hostname or virtual machine name.
- Source
- secalert@redhat.com
- NVD status
- Modified
Social media
- Hype score
- Not currently trending
Risk scores
CVSS 2.0
- Type
- Primary
- Base score
- 6.9
- Impact score
- 10
- Exploitability score
- 3.4
- Vector string
- AV:L/AC:M/Au:N/C:C/I:C/A:C
Weaknesses
- nvd@nist.gov
- CWE-20
Configurations
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:gentoo:logrotate:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CBB1E3AD-DFB4-4A8F-9753-0049B41BC155",
"versionEndIncluding": "3.7.9"
},
{
"criteria": "cpe:2.3:a:gentoo:logrotate:3.3:r2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9E2EEED0-4022-467B-9EBF-E6DA61B16B16"
},
{
"criteria": "cpe:2.3:a:gentoo:logrotate:3.5.9:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2BE715C9-9C25-4998-90D3-556E53B177B0"
},
{
"criteria": "cpe:2.3:a:gentoo:logrotate:3.5.9:r1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "812F126C-8855-468A-B723-24C8AEF325E3"
},
{
"criteria": "cpe:2.3:a:gentoo:logrotate:3.6.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FAAE7BE5-701A-4A90-8163-5ABAC49121CE"
},
{
"criteria": "cpe:2.3:a:gentoo:logrotate:3.6.5:r1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A142B712-B06E-4E87-B7A8-DE12E94C25EE"
},
{
"criteria": "cpe:2.3:a:gentoo:logrotate:3.7:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "22668C8E-3C09-4DF2-91B2-C2F699AF8A79"
},
{
"criteria": "cpe:2.3:a:gentoo:logrotate:3.7.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "61673333-B183-4C09-9012-D78E05FE48EB"
},
{
"criteria": "cpe:2.3:a:gentoo:logrotate:3.7.1:r1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C54EBB10-0359-444F-9726-0406D6F8DD40"
},
{
"criteria": "cpe:2.3:a:gentoo:logrotate:3.7.1:r2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "810F039B-E454-446B-94D2-97C67B814483"
},
{
"criteria": "cpe:2.3:a:gentoo:logrotate:3.7.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EACBE194-176D-40BD-AA9E-4179D25A48EC"
},
{
"criteria": "cpe:2.3:a:gentoo:logrotate:3.7.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7FA8A482-13E0-4B01-A32F-7AB46FED3ACE"
},
{
"criteria": "cpe:2.3:a:gentoo:logrotate:3.7.7:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "47E3950C-3FBB-41D8-BBA7-FEAB540859A1"
},
{
"criteria": "cpe:2.3:a:gentoo:logrotate:3.7.8:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BEB650B0-8CDB-4DE9-94CE-48E78A453262"
}
],
"operator": "OR"
}
]
}
]