exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Ubuntu Security Notice USN-1078-1

Ubuntu Security Notice USN-1078-1
Posted Mar 1, 2011
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 1078-1 - Dominik George discovered that logwatch did not properly sanitize log file names that were passed to the shell as part of a command. If a remote attacker were able to generate specially crafted filenames (for example, via Samba logging), they could execute arbitrary code with root privileges.

tags | advisory, remote, arbitrary, shell, root
systems | linux, ubuntu
advisories | CVE-2011-1018
SHA-256 | 0f547aa43b22177b3cdef403c9b0e44b89e5196125c31c09f67ed05eff3feaf3

Ubuntu Security Notice USN-1078-1

Change Mirror Download
===========================================================
Ubuntu Security Notice USN-1078-1 March 01, 2011
logwatch vulnerability
CVE-2011-1018
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 8.04 LTS
Ubuntu 9.10
Ubuntu 10.04 LTS
Ubuntu 10.10

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 8.04 LTS:
logwatch 7.3.6-1ubuntu1.1

Ubuntu 9.10:
logwatch 7.3.6.cvs20090906-1ubuntu1.1

Ubuntu 10.04 LTS:
logwatch 7.3.6.cvs20090906-1ubuntu2.1

Ubuntu 10.10:
logwatch 7.3.6.cvs20090906-1ubuntu3.1

In general, a standard system update will make all the necessary changes.

Details follow:

Dominik George discovered that logwatch did not properly sanitize
log file names that were passed to the shell as part of a command.
If a remote attacker were able to generate specially crafted filenames
(for example, via Samba logging), they could execute arbitrary code
with root privileges.


Updated packages for Ubuntu 8.04 LTS:

Source archives:

http://security.ubuntu.com/ubuntu/pool/main/l/logwatch/logwatch_7.3.6-1ubuntu1.1.diff.gz
Size/MD5: 15656 31f40f13457aeb20f21c2cfd2ad460b8
http://security.ubuntu.com/ubuntu/pool/main/l/logwatch/logwatch_7.3.6-1ubuntu1.1.dsc
Size/MD5: 1413 037612770004ad6b553b8c5b02840350
http://security.ubuntu.com/ubuntu/pool/main/l/logwatch/logwatch_7.3.6.orig.tar.gz
Size/MD5: 297296 937d982006b2a76a83edfcfd2e5a9d7d

Architecture independent packages:

http://security.ubuntu.com/ubuntu/pool/main/l/logwatch/logwatch_7.3.6-1ubuntu1.1_all.deb
Size/MD5: 307458 da69f492898cee9560bb752b87e8af1c

Updated packages for Ubuntu 9.10:

Source archives:

http://security.ubuntu.com/ubuntu/pool/main/l/logwatch/logwatch_7.3.6.cvs20090906-1ubuntu1.1.diff.gz
Size/MD5: 87133 eb1efb5614967c87dcee5a0627db91a2
http://security.ubuntu.com/ubuntu/pool/main/l/logwatch/logwatch_7.3.6.cvs20090906-1ubuntu1.1.dsc
Size/MD5: 1932 b32ef1d8ada8a539c73a6e8da732a7c8
http://security.ubuntu.com/ubuntu/pool/main/l/logwatch/logwatch_7.3.6.cvs20090906.orig.tar.gz
Size/MD5: 338115 b12229916e0a5891a8c1da59afb61e40

Architecture independent packages:

http://security.ubuntu.com/ubuntu/pool/main/l/logwatch/logwatch_7.3.6.cvs20090906-1ubuntu1.1_all.deb
Size/MD5: 400012 6a943f596ed79064930b328a7058357e

Updated packages for Ubuntu 10.04 LTS:

Source archives:

http://security.ubuntu.com/ubuntu/pool/main/l/logwatch/logwatch_7.3.6.cvs20090906-1ubuntu2.1.diff.gz
Size/MD5: 87803 0bba6a4701307c1abb9fea16c15c11fd
http://security.ubuntu.com/ubuntu/pool/main/l/logwatch/logwatch_7.3.6.cvs20090906-1ubuntu2.1.dsc
Size/MD5: 1932 d87291a904f97e6c13dc15f0c996eeb4
http://security.ubuntu.com/ubuntu/pool/main/l/logwatch/logwatch_7.3.6.cvs20090906.orig.tar.gz
Size/MD5: 338115 b12229916e0a5891a8c1da59afb61e40

Architecture independent packages:

http://security.ubuntu.com/ubuntu/pool/main/l/logwatch/logwatch_7.3.6.cvs20090906-1ubuntu2.1_all.deb
Size/MD5: 401512 d68a24ddbbfde6880fdbff79290bf344

Updated packages for Ubuntu 10.10:

Source archives:

http://security.ubuntu.com/ubuntu/pool/main/l/logwatch/logwatch_7.3.6.cvs20090906-1ubuntu3.1.diff.gz
Size/MD5: 90181 971dda35e4fa086a1bab9b9d7814a0df
http://security.ubuntu.com/ubuntu/pool/main/l/logwatch/logwatch_7.3.6.cvs20090906-1ubuntu3.1.dsc
Size/MD5: 1932 388d1296df12dc1f46d0ddebfe6bf6ae
http://security.ubuntu.com/ubuntu/pool/main/l/logwatch/logwatch_7.3.6.cvs20090906.orig.tar.gz
Size/MD5: 338115 b12229916e0a5891a8c1da59afb61e40

Architecture independent packages:

http://security.ubuntu.com/ubuntu/pool/main/l/logwatch/logwatch_7.3.6.cvs20090906-1ubuntu3.1_all.deb
Size/MD5: 398960 d7967323e366778cc5c79701aa1dc156


Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    0 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close