CVE-2011-1018
logwatch.pl in Logwatch 7.3.6 allows remote attackers to execute arbitrary commands via shell...
CVE-2011-1018 is a high vulnerability (CVSS 10.0) in Logwatch, published February 25, 2011. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 18.3%, the 97th percentile. Fixed in logwatch 7.3.6.cvs20090906-2.
- Severity
- 10.0 HighCVSS 2.0, NVD
- Exploit chance
- 18.3%EPSS, 97th percentile
- Exploitation
- None known1 public exploit
- Fixed in
7.3.6.cvs20090906-2logwatch +10 more
Description
logwatch.pl in Logwatch 7.3.6 allows remote attackers to execute arbitrary commands via shell metacharacters in a log file name, as demonstrated via a crafted username to a Samba server.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
logwatchDebian:12 | before 7.3.6.cvs20090906-2 | 7.3.6.cvs20090906-2 |
logwatchDebian:13 | before 7.3.6.cvs20090906-2 | 7.3.6.cvs20090906-2 |
logwatchDebian:14 | before 7.3.6.cvs20090906-2 | 7.3.6.cvs20090906-2 |
logwatchDebian:5.0 | before 7.3.6.cvs20080702-2lenny1, plus listed versions 7.3.6.cvs20080702-2 | 7.3.6.cvs20080702-2lenny1 |
logwatchDebian:6.0 | before 7.3.6.cvs20090906-1squeeze1, plus listed versions 7.3.6.cvs20090906-1 | 7.3.6.cvs20090906-1squeeze1 |
logwatchRed Hat:enterprise_linux:5::server | before 0:7.3-9.el5_6 | 0:7.3-9.el5_6 |
logwatchRed Hat:enterprise_linux:6::client | before 0:7.3.6-49.el6 | 0:7.3.6-49.el6 |
logwatchRed Hat:enterprise_linux:6::computenode | before 0:7.3.6-49.el6 | 0:7.3.6-49.el6 |
logwatchRed Hat:enterprise_linux:6::server | before 0:7.3.6-49.el6 | 0:7.3.6-49.el6 |
logwatchRed Hat:enterprise_linux:6::workstation | before 0:7.3.6-49.el6 | 0:7.3.6-49.el6 |
logwatchopenSUSE:Tumbleweed | before 7.4.3-1.4 | 7.4.3-1.4 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Logwatch Log File - Special Characters Privilege Escalation | 2011-02-24 |
What each source reports
NVD Score used
logwatch.pl in Logwatch 7.3.6 allows remote attackers to execute arbitrary commands via shell metacharacters in a log file name, as demonstrated via a crafted username to a Samba server.
- Record
CVE-2011-1018- CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE ListNo score
logwatch.pl in Logwatch 7.3.6 allows remote attackers to execute arbitrary commands via shell metacharacters in a log file name, as demonstrated via a crafted username to a Samba server.
- Record
CVE-2011-1018- Updated
- 2026-11-02
EUVDEUVD-2011-1035No score
logwatch.pl in Logwatch 7.3.6 allows remote attackers to execute arbitrary commands via shell metacharacters in a log file name, as demonstrated via a crafted username to a Samba server.
- Record
EUVD-2011-1035- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-g657-whx2-ph73No score
logwatch.pl in Logwatch 7.3.6 allows remote attackers to execute arbitrary commands via shell...
logwatch.pl in Logwatch 7.3.6 allows remote attackers to execute arbitrary commands via shell metacharacters in a log file name, as demonstrated via a crafted username to a Samba server.
- Record
GHSA-g657-whx2-ph73- Weakness
- CWE-20
- Updated
- 2026-11-02
OSVNo score
logwatch.pl in Logwatch 7.3.6 allows remote attackers to execute arbitrary commands via shell metacharacters in a log file name, as demonstrated via a crafted username to a Samba server.
- Record
CVE-2011-1018- Updated
- 2026-11-02
OSVDEBIAN-CVE-2011-1018No score
logwatch.pl in Logwatch 7.3.6 allows remote attackers to execute arbitrary commands via shell metacharacters in a log file name, as demonstrated via a crafted username to a Samba server.
- Record
DEBIAN-CVE-2011-1018- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10097-1No score
logwatch-7.4.3-1.4 on GA media
These are all security issues fixed in the logwatch-7.4.3-1.4 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10097-1- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
openwall.com/lists/oss-security/2011/02/24/15
sourceforge.net/tracker?func=detail&aid=3184223&group_id=312875&atid=1316824
vupen.com/english/advisories/2011/0581
secunia.com/advisories/43495
lists.fedoraproject.org/pipermail/package-announce/2011-March/055585.html
debian.org/security/2011/dsa-2182
Show 26 moreShow less
lists.opensuse.org/opensuse-security-announce/2011-04/msg00000.html
redhat.com/support/errata/RHSA-2011-0324.html
securityfocus.com/bid/46554
logwatch.svn.sourceforge.net/viewvc/logwatch/scripts/logwatch.pl?r1=3&r2=26&pathrev=26
ubuntu.com/usn/USN-1078-1
bugzilla.redhat.com/show_bug.cgi?id=680237
securitytracker.com/id?1025165
nvd.nist.gov/vuln/detail/CVE-2011-1018
access.redhat.com/errata/RHSA-2011:0324
github.com/advisories/GHSA-g657-whx2-ph73
security-tracker.debian.org/tracker/CVE-2011-1018
security.access.redhat.com/data/csaf/v2/advisories/2011/rhsa-2011_0324.json
cve.org/CVERecord?id=CVE-2011-1018
suse.com/security/cve/CVE-2011-1018