CVE-2011-1018 in the critical feed json
logwatch.pl in Logwatch 7.3.6 allows remote attackers to execute arbitrary commands via shell metacharacters in a log file name, as demonst…
published 2011-02-25 15 y ago modified 2026-06-16 4 mo ago also EUVD-2011-1035
- cvss
- 10.0
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 18.3%
- EPSS 18.3% chance of exploitation in 30 days, percentile 97%
- public exploits
- 1
- Exploit-DB
Summary
logwatch.pl in Logwatch 7.3.6 allows remote attackers to execute arbitrary commands via shell metacharacters in a log file name, as demonstrated via a crafted username to a Samba server.
Patch / fix
- logwatch Debian 14, Debian 13, Debian 12 7.3.6.cvs20090906-2
debian advisories DEBIAN-CVE-2011-1018
- logwatch RHEL 5 7.3-9.el5_6
- logwatch RHEL 6 7.3.6-49.el6
red hat advisories RHSA-2011:0324
- logwatch openSUSE Tumbleweed 7.4.3-1.4
opensuse advisories openSUSE-SU-2024:10097-1
- openwall.com/lists/oss-security/2011/02/24/15 patch
- sourceforge.net/tracker/?func=detail&aid=3184223&group_id=312875&atid=1316… patch
- openwall.com/lists/oss-security/2011/02/24/13 patch
- logwatch.svn.sourceforge.net/viewvc/logwatch/scripts/logwatch.pl?r1=3&r2=26&pathrev=26 patch
- bugzilla.redhat.com/show_bug.cgi?id=680237 patch
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2011-1018 updated cvss 7.9
logwatch: Privilege escalation due improper sanitization of special characters in log file names
-
Red Hat Enterprise Linux (v. 5.6.z server) logwatch 7.3-9.el5_6 Red Hat Enterprise Linux Desktop (v. 6) logwatch 7.3.6-49.el6 Red Hat Enterprise Linux HPC Node (v. 6) logwatch 7.3.6-49.el6 Red Hat Enterprise Linux Server (v. 6) logwatch 7.3.6-49.el6 Red Hat Enterprise Linux Workstation (v. 6) logwatch 7.3.6-49.el6fixed: vendor fix RHSA-2011:0324
-
Red Hat Enterprise Linux 4 logwatchnot affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Timeline
- First public exploit (EDB-35386)
- Published
Exploit prediction
18.32% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- EDB-35386 Logwatch Log File - Special Characters Privilege Escalation remote, 2011-02-24
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 10.0 | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Classification
- Weakness
-
- CWE-20 Improper Input Validation
References
-
openwall.com
/lists/oss-security/2011/02/24/15
mailing-list, patch
-
sourceforge.net
/tracker/?func=detail&aid=3184223&group_id=312875&atid=1316824
patch
-
openwall.com
/lists/oss-security/2011/02/24/13
mailing-list, patch
-
logwatch.svn.sourceforge.net
/viewvc/logwatch/scripts/logwatch.pl?r1=3&r2=26&pathrev=26
patch
-
bugzilla.redhat.com
/show_bug.cgi?id=680237
patch
-
lists.fedoraproject.org
/pipermail/package-announce/2011-March/055585.html
vendor-advisory
-
debian.org
/security/2011/dsa-2182
vendor-advisory
-
lists.fedoraproject.org
/pipermail/package-announce/2011-March/055617.html
vendor-advisory
-
lists.opensuse.org
/opensuse-security-announce/2011-04/msg00000.html
vendor-advisory
-
redhat.com
/support/errata/RHSA-2011-0324.html
vendor-advisory
-
ubuntu.com
/usn/USN-1078-1
vendor-advisory
-
lists.fedoraproject.org
/pipermail/package-announce/2011-March/055579.html
vendor-advisory
-
secunia.com
/advisories/43495
third-party-advisory, vendor-advisory
-
vupen.com
/english/advisories/2011/0581
vdb-entry
-
secunia.com
/advisories/43356
third-party-advisory
-
vupen.com
/english/advisories/2011/0533
vdb-entry
-
secunia.com
/advisories/43644
third-party-advisory
-
secunia.com
/advisories/43622
third-party-advisory
-
securityfocus.com
/bid/46554
vdb-entry
-
vupen.com
/english/advisories/2011/0596
vdb-entry
-
sourceforge.net
/mailarchive/forum.php?thread_name=4D604843.7040303%40mblmail.net&forum_name=logwatch-devel
mailing-list
-
secunia.com
/advisories/43734
third-party-advisory
-
securitytracker.com
/id?1025165
vdb-entry
Sources
- CVE List CVE-2011-1018
- NVD CVE-2011-1018
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.