CVE-2011-1154

{"id": "CVE-2011-1154", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.9, "accessVector": "LOCAL", "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 3.4, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2011-03-30T22:55:02.360", "references": [{"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057845.html", "source": "secalert@redhat.com"}, {"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056992.html", "tags": ["Patch"], "source": "secalert@redhat.com"}, {"url": "http://openwall.com/lists/oss-security/2011/03/04/16", "source": "secalert@redhat.com"}, {"url": "http://openwall.com/lists/oss-security/2011/03/04/17", "source": "secalert@redhat.com"}, {"url": "http://openwall.com/lists/oss-security/2011/03/04/18", "source": "secalert@redhat.com"}, {"url": "http://openwall.com/lists/oss-security/2011/03/04/19", "source": "secalert@redhat.com"}, {"url": "http://openwall.com/lists/oss-security/2011/03/04/22", "source": "secalert@redhat.com"}, {"url": "http://openwall.com/lists/oss-security/2011/03/04/24", "source": "secalert@redhat.com"}, {"url": "http://openwall.com/lists/oss-security/2011/03/04/25", "source": "secalert@redhat.com"}, {"url": "http://openwall.com/lists/oss-security/2011/03/04/26", "source": "secalert@redhat.com"}, {"url": "http://openwall.com/lists/oss-security/2011/03/04/27", "source": "secalert@redhat.com"}, {"url": "http://openwall.com/lists/oss-security/2011/03/04/28", "source": "secalert@redhat.com"}, {"url": "http://openwall.com/lists/oss-security/2011/03/04/29", "source": "secalert@redhat.com"}, {"url": "http://openwall.com/lists/oss-security/2011/03/04/30", "source": "secalert@redhat.com"}, {"url": "http://openwall.com/lists/oss-security/2011/03/04/31", "source": "secalert@redhat.com"}, {"url": "http://openwall.com/lists/oss-security/2011/03/04/32", "source": "secalert@redhat.com"}, {"url": "http://openwall.com/lists/oss-security/2011/03/04/33", "source": "secalert@redhat.com"}, {"url": "http://openwall.com/lists/oss-security/2011/03/05/4", "source": "secalert@redhat.com"}, {"url": "http://openwall.com/lists/oss-security/2011/03/05/6", "source": "secalert@redhat.com"}, {"url": "http://openwall.com/lists/oss-security/2011/03/05/8", "source": "secalert@redhat.com"}, {"url": "http://openwall.com/lists/oss-security/2011/03/06/3", "source": "secalert@redhat.com"}, {"url": "http://openwall.com/lists/oss-security/2011/03/06/4", "source": "secalert@redhat.com"}, {"url": "http://openwall.com/lists/oss-security/2011/03/06/5", "source": "secalert@redhat.com"}, {"url": "http://openwall.com/lists/oss-security/2011/03/06/6", "source": "secalert@redhat.com"}, {"url": "http://openwall.com/lists/oss-security/2011/03/07/11", "tags": ["Patch"], "source": "secalert@redhat.com"}, {"url": "http://openwall.com/lists/oss-security/2011/03/07/5", "source": "secalert@redhat.com"}, {"url": "http://openwall.com/lists/oss-security/2011/03/07/6", "source": "secalert@redhat.com"}, {"url": "http://openwall.com/lists/oss-security/2011/03/08/5", "source": "secalert@redhat.com"}, {"url": "http://openwall.com/lists/oss-security/2011/03/10/2", "source": "secalert@redhat.com"}, {"url": "http://openwall.com/lists/oss-security/2011/03/10/3", "source": "secalert@redhat.com"}, {"url": "http://openwall.com/lists/oss-security/2011/03/10/6", "source": "secalert@redhat.com"}, {"url": "http://openwall.com/lists/oss-security/2011/03/10/7", "source": "secalert@redhat.com"}, {"url": "http://openwall.com/lists/oss-security/2011/03/11/3", "source": "secalert@redhat.com"}, {"url": "http://openwall.com/lists/oss-security/2011/03/11/5", "source": "secalert@redhat.com"}, {"url": "http://openwall.com/lists/oss-security/2011/03/14/26", "source": "secalert@redhat.com"}, {"url": "http://openwall.com/lists/oss-security/2011/03/23/11", "source": "secalert@redhat.com"}, {"url": "http://secunia.com/advisories/43955", "source": "secalert@redhat.com"}, {"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:065", "source": "secalert@redhat.com"}, {"url": "http://www.redhat.com/support/errata/RHSA-2011-0407.html", "source": "secalert@redhat.com"}, {"url": "http://www.vupen.com/english/advisories/2011/0791", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "http://www.vupen.com/english/advisories/2011/0872", "source": "secalert@redhat.com"}, {"url": "http://www.vupen.com/english/advisories/2011/0961", "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=680796", "tags": ["Patch"], "source": "secalert@redhat.com"}, {"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057845.html", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056992.html", "tags": ["Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://openwall.com/lists/oss-security/2011/03/04/16", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://openwall.com/lists/oss-security/2011/03/04/17", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://openwall.com/lists/oss-security/2011/03/04/18", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://openwall.com/lists/oss-security/2011/03/04/19", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://openwall.com/lists/oss-security/2011/03/04/22", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://openwall.com/lists/oss-security/2011/03/04/24", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://openwall.com/lists/oss-security/2011/03/04/25", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://openwall.com/lists/oss-security/2011/03/04/26", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://openwall.com/lists/oss-security/2011/03/04/27", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://openwall.com/lists/oss-security/2011/03/04/28", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://openwall.com/lists/oss-security/2011/03/04/29", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://openwall.com/lists/oss-security/2011/03/04/30", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://openwall.com/lists/oss-security/2011/03/04/31", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://openwall.com/lists/oss-security/2011/03/04/32", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://openwall.com/lists/oss-security/2011/03/04/33", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://openwall.com/lists/oss-security/2011/03/05/4", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://openwall.com/lists/oss-security/2011/03/05/6", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://openwall.com/lists/oss-security/2011/03/05/8", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://openwall.com/lists/oss-security/2011/03/06/3", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://openwall.com/lists/oss-security/2011/03/06/4", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://openwall.com/lists/oss-security/2011/03/06/5", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://openwall.com/lists/oss-security/2011/03/06/6", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://openwall.com/lists/oss-security/2011/03/07/11", "tags": ["Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://openwall.com/lists/oss-security/2011/03/07/5", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://openwall.com/lists/oss-security/2011/03/07/6", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://openwall.com/lists/oss-security/2011/03/08/5", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://openwall.com/lists/oss-security/2011/03/10/2", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://openwall.com/lists/oss-security/2011/03/10/3", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://openwall.com/lists/oss-security/2011/03/10/6", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://openwall.com/lists/oss-security/2011/03/10/7", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://openwall.com/lists/oss-security/2011/03/11/3", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://openwall.com/lists/oss-security/2011/03/11/5", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://openwall.com/lists/oss-security/2011/03/14/26", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://openwall.com/lists/oss-security/2011/03/23/11", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://secunia.com/advisories/43955", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:065", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.redhat.com/support/errata/RHSA-2011-0407.html", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.vupen.com/english/advisories/2011/0791", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.vupen.com/english/advisories/2011/0872", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.vupen.com/english/advisories/2011/0961", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=680796", "tags": ["Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "The shred_file function in logrotate.c in logrotate 3.7.9 and earlier might allow context-dependent attackers to execute arbitrary commands via shell metacharacters in a log filename, as demonstrated by a filename that is automatically constructed on the basis of a hostname or virtual machine name."}, {"lang": "es", "value": "La funci\u00f3n shred_file en logrotate.c en logrotate v3.7.9 y anteriores puede permitir a atacantes dependiendo del contexto, ejecutar comandos v\u00eda metacaracteres de la shell en un fichero de registro, como lo demuestra un nombre de archivo que es contruido de forma autom\u00e1tica sobre la base de un nombre de host o m\u00e1quina virtual."}], "lastModified": "2024-11-21T01:25:40.543", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gentoo:logrotate:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CBB1E3AD-DFB4-4A8F-9753-0049B41BC155", "versionEndIncluding": "3.7.9"}, {"criteria": "cpe:2.3:a:gentoo:logrotate:3.3:r2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9E2EEED0-4022-467B-9EBF-E6DA61B16B16"}, {"criteria": "cpe:2.3:a:gentoo:logrotate:3.5.9:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2BE715C9-9C25-4998-90D3-556E53B177B0"}, {"criteria": "cpe:2.3:a:gentoo:logrotate:3.5.9:r1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "812F126C-8855-468A-B723-24C8AEF325E3"}, {"criteria": "cpe:2.3:a:gentoo:logrotate:3.6.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FAAE7BE5-701A-4A90-8163-5ABAC49121CE"}, {"criteria": "cpe:2.3:a:gentoo:logrotate:3.6.5:r1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A142B712-B06E-4E87-B7A8-DE12E94C25EE"}, {"criteria": "cpe:2.3:a:gentoo:logrotate:3.7:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "22668C8E-3C09-4DF2-91B2-C2F699AF8A79"}, {"criteria": "cpe:2.3:a:gentoo:logrotate:3.7.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "61673333-B183-4C09-9012-D78E05FE48EB"}, {"criteria": "cpe:2.3:a:gentoo:logrotate:3.7.1:r1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C54EBB10-0359-444F-9726-0406D6F8DD40"}, {"criteria": "cpe:2.3:a:gentoo:logrotate:3.7.1:r2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "810F039B-E454-446B-94D2-97C67B814483"}, {"criteria": "cpe:2.3:a:gentoo:logrotate:3.7.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EACBE194-176D-40BD-AA9E-4179D25A48EC"}, {"criteria": "cpe:2.3:a:gentoo:logrotate:3.7.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7FA8A482-13E0-4B01-A32F-7AB46FED3ACE"}, {"criteria": "cpe:2.3:a:gentoo:logrotate:3.7.7:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "47E3950C-3FBB-41D8-BBA7-FEAB540859A1"}, {"criteria": "cpe:2.3:a:gentoo:logrotate:3.7.8:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BEB650B0-8CDB-4DE9-94CE-48E78A453262"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}