shadow pwdcheck.c allows account modification
| shadow-pwdcheck-modify-account (17902) |  High Risk |
Description:
shadow could allow a local attacker to perform unauthorized account modifications, caused by a vulnerability in the chfn and chsh change utilities. The passwd_check function in the libmisc/pwdcheck.c file fails to properly validate user privileges. A local unauthorized user could use this vulnerability to modify account information.
Platforms Affected:
- Canonical, Ubuntu 4.10
- Conectiva, Linux 10
- Conectiva, Linux 9.0
- Debian, Debian Linux 3.0
- Gentoo, Linux
- Linux Shadow SUITE, shadow prior to 4.0.5
- MandrakeSoft, Mandrake Linux 10.0 AMD64
- MandrakeSoft, Mandrake Linux 10.0
- MandrakeSoft, Mandrake Linux 10.1
- MandrakeSoft, Mandrake Linux 10.1 X86_64
- MandrakeSoft, Mandrake Linux 9.2 AMD64
- MandrakeSoft, Mandrake Linux 9.2
- MandrakeSoft, Mandrake Linux Corporate Server 2.1
- MandrakeSoft, Mandrake Linux Corporate Server 2.1 X86_64
- MandrakeSoft, Mandrake Multi Network Firewall 8.2
- Turbolinux, Turbolinux 10 Desktop
- Turbolinux, Turbolinux 10 F...
- Turbolinux, Turbolinux 10 Server
- Turbolinux, Turbolinux 7 Server
- Turbolinux, Turbolinux 7 Workstation
- Turbolinux, Turbolinux 8 Server
- Turbolinux, Turbolinux 8 Workstation
- Turbolinux, Turbolinux Appliance Server 1.0
- Turbolinux, Turbolinux Home
- Turbolinux, Turbolinux Appliance Server 1.0 Hosting Ed
- Turbolinux, Turbolinux Appliance Server 1.0 Workgroup Ed
Remedy:
Upgrade to the latest version of shadow (4.0.5 or later), available from the shadow Web site. See References.
For Mandrake Linux:
Upgrade to the latest shadow-utils package, as listed below. Refer to MandrakeSoft Security Advisory MDKSA-2004:126 for more information. See References.
Mandrake Linux 10.1: 4.0.3-8.1.101mdkmdk or later
Mandrake Linux 9.2: 4.0.3-5.1.92mdk or later
Mandrake Linux Multi Network Firewall 8.2: 20000902-5.2.M82mdk or later
Mandrake Linux Corporate Server 2.1: 20000902-10.1.C21mdk or later
Mandrake Linux 10.0: 4.0.3-8.1.100mdk or later
For Gentoo Linux:
Upgrade to the latest version of shadow (4.0.5-r1 or later), as listed in GLSA 200411-09. See References.
For Debian GNU/Linux 3.0 (alias woody):
Upgrade to the latest shadow package (20000902-12woody1 or later), as listed in DSA-585-1. See References.
For Ubuntu Linux:
Upgrade to the latest shadow package (4.0.3-28.5ubuntu6.1 or later), as listed in USN-17-1 November 04, 2004. See References.
For Conectiva Linux:
Upgrade to the latest shadow-utils package, as listed below. Refer to Conectiva Linux Security Announcement CLSA-2004:894 for more information. See References.
Conectiva Linux 10.0: 4.0.3-58499U10_1cl or later Conectiva Linux 9: 4.0.3-26706U90_1cl or later
For Turbolinux:
Upgrade to the latest shadow-utils package, as listed below. Refer to Turbolinux Security Advisory TLSA-2005-16 for more information. See References.
Turbolinux Appliance Server 1.0 Hosting Edition: 20000902-13 or later
Turbolinux Appliance Server 1.0 Workgroup Edition: 20000902-13 or later
Turbolinux 10 Server: 20000902-13 or later
Turbolinux Home: 20000902-13 or later
Turbolinux 10 Desktop: 20000902-13 or later
Turbolinux 8 Server: 20000902-13 or later
Turbolinux 8 Workstation: 19990827-10 or later
Turbolinux 7 Server: 19990827-10 or later
Turbolinux 7 Workstation: 19990827-10 or later
For other distributions:
Contact your vendor for upgrade or patch information.
Consequences:
Data Manipulation
References:
- Conectiva Linux Security Announcement CLSA-2004:894, Fix for shadow-utils authentication bypass vulnerability at http://distro.conectiva.com.br/atualizacoes/index.php?id=a&anuncio=000894.
- Linux Online Web site, Shadow Password at http://www.linux.org/docs/ldp/howto/Shadow-Password-HOWTO.html.
- BID-11564: Shadow Authentication Bypass Vulnerability
- CVE-2004-1001: Unknown vulnerability in the passwd_check function in Shadow 4.0.4.1, and possibly other versions before 4.0.5, allows local users to conduct unauthorized activities when an error from a pam_chauthtok function call is not properly handled.
- DSA-585: shadow -- programming error
- GLSA-200411-09: shadow: Unauthorized modification of account information
- MDKSA-2004:126: Updated shadow-utils packages fix security bypass vulnerability
- SA13028: Shadow "passwd_check()" Security Bypass Vulnerability
Reported:
Oct 28, 2004
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net