Test ID:	1.3.6.1.4.1.25623.1.0.69135
Category:	Ubuntu Local Security Checks
Title:	Ubuntu USN-1078-1 (logwatch)
Summary:	Ubuntu USN-1078-1 (logwatch)
Description:	The remote host is missing an update to logwatch announced via advisory USN-1078-1. Details follow: Dominik George discovered that logwatch did not properly sanitize log file names that were passed to the shell as part of a command. If a remote attacker were able to generate specially crafted filenames (for example, via Samba logging), they could execute arbitrary code with root privileges. Solution: The problem can be corrected by upgrading your system to the following package versions: Ubuntu 8.04 LTS: logwatch 7.3.6-1ubuntu1.1 Ubuntu 9.10: logwatch 7.3.6.cvs20090906-1ubuntu1.1 Ubuntu 10.04 LTS: logwatch 7.3.6.cvs20090906-1ubuntu2.1 Ubuntu 10.10: logwatch 7.3.6.cvs20090906-1ubuntu3.1 In general, a standard system update will make all the necessary changes. http://www.securityspace.com/smysecure/catid.html?in=USN-1078-1 Risk factor : Critical
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2011-1018 http://sourceforge.net/mailarchive/forum.php?thread_name=4D604843.7040303%40mblmail.net&forum_name=logwatch-devel http://www.openwall.com/lists/oss-security/2011/02/24/13 http://www.openwall.com/lists/oss-security/2011/02/24/15 Debian Security Information: DSA-2182 (Google Search) http://www.debian.org/security/2011/dsa-2182 http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055585.html http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055579.html http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055617.html http://www.redhat.com/support/errata/RHSA-2011-0324.html http://www.ubuntu.com/usn/USN-1078-1 BugTraq ID: 46554 http://www.securityfocus.com/bid/46554 http://www.securitytracker.com/id?1025165 http://secunia.com/advisories/43495 http://secunia.com/advisories/43356 http://secunia.com/advisories/43622 http://secunia.com/advisories/43644 http://secunia.com/advisories/43734 http://www.vupen.com/english/advisories/2011/0533 http://www.vupen.com/english/advisories/2011/0581 http://www.vupen.com/english/advisories/2011/0596
Copyright	Copyright (c) 2011 E-Soft Inc. http://www.securityspace.com

This is only one of 32582 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.

New User Registration Email: UserID: Passwd: Please email me your monthly newsletters, informing the latest services, improvements & surveys. Please email me a vulnerability test announcement whenever a new test is added.     Privacy

Registered User Login   UserID:     Passwd:     Forgot userid or passwd? Email/Userid: