CVE-2011-1154

Name of the Vulnerable Software and Affected Versions logrotate versions 3.7.9 and earlier logrotate versions prior to 3.8.0

Description The issue allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a log filename. This can be demonstrated by a filename that is automatically constructed on the basis of a hostname or virtual machine name. Exploitation of the vulnerabilities can lead to disruption of confidentiality, integrity, and availability of protected information and can be performed locally.

Recommendations For logrotate versions 3.7.9 and earlier, update to version 3.8.0 or later. For logrotate versions prior to 3.8.0, update to version 3.8.0 or later. As a temporary workaround, consider restricting access to the shred file function in logrotate.c until a patch is available.