K16870 : logrotate vulnerability CVE-2011-1154

Security Advisory Description

The shred_file function in logrotate.c in logrotate 3.7.9 and earlier might allow context-dependent attackers to execute arbitrary commands via shell metacharacters in a log filename, as demonstrated by a filename that is automatically constructed on the basis of a hostname or virtual machine name.
(
CVE-2011-1154
)
Impact
This vulnerability may allow context-dependent attackers to execute arbitrary commands via shell meta characters in a log file name.