Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 5

Export CSV
CVE-2023-29383

shadow: Improper input validation in shadow-utils package utility chfn

In Shadow 4.13, it is possible to inject control characters into fields provided to the SUID program chfn (change finger). Although it is not possible to exploit this directly (e.g., adding a new user fails because \n is in the block list), it is possible to misrepresent the /etc/passwd file when viewed. Use of \r manipulations and Unicode characters to work around blocking of the : character make it possible to give the impression that a new user has been added. In other words, an adversary may be able to convince a system administrator to take the system offline (an indirect, social-engineered denial of service) by demonstrating that "cat /etc/passwd" shows a rogue user account.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Shadow Project
Products
Shadow
CVE-2016-6252

shadow-utils: Incorrect integer handling results in LPE

Integer overflow in shadow 4.2.1 allows local users to gain privileges via crafted input to newuidmap.

CVSS 3.0 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Shadow Project
Products
Shadow
CVE-2017-12424

shadow-utils: Buffer overflow via newusers tool

In shadow before 4.5, the newusers tool could be made to manipulate internal data structures in ways unintended by the authors. Malformed input may lead to crashes (with a buffer overflow or other memory corruption) or other unspecified behaviors. This crosses a privilege boundary in, for example, certain web-hosting environments in which a Control Panel allows an unprivileged user account to create subaccounts.

CVSS 3.1 · 9.8 Critical EPSS 2.7% KEV · Not listed
Vendors
Debian Shadow Project
Products
Debian Linux Shadow
CVE-2019-19882

shadow-utils: local users can obtain root access because setuid programs are misconfigured

shadow 4.8, in certain circumstances affecting at least Gentoo, Arch Linux, and Void Linux, allows local users to obtain root access because setuid programs are misconfigured. Specifically, this affects shadow 4.8 when compiled using --with-libpam but without explicitly passing --disable-account-tools-setuid, and without a PAM configuration suitable for use with setuid account management tools. This combination leads to account management tools (groupadd, groupdel, groupmod, useradd, userdel, usermod) that can easily be used by unprivileged local users to escalate privileges to root in multiple ways. This issue became much more relevant in approximately December 2019 when an unrelated bug was fixed (i.e., the chmod calls to suidusbins were fixed in the upstream Makefile which is now included in the release version 4.8).

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Shadow Project
Products
Shadow
CVE-2018-7169

shadow-utils: newgidmap allows unprivileged user to drop supplementary groups potentially allowing privilege escalation

An issue was discovered in shadow 4.5. newgidmap (in shadow-utils) is setuid and allows an unprivileged user to be placed in a user namespace where setgroups(2) is permitted. This allows an attacker to remove themselves from a supplementary group, which may allow access to certain filesystem paths if the administrator has used "group blacklisting" (e.g., chmod g-rwx) to restrict access to paths. This flaw effectively reverts a security feature in the kernel (in particular, the /proc/self/setgroups knob) to prevent this sort of privilege escalation.

CVSS 3.0 · 5.3 Medium EPSS 1.6% KEV · Not listed
Vendors
Shadow Project
Products
Shadow