Ubuntu 4.10 : passwd vulnerabilities (USN-17-1)

Ubuntu Security Notice (C) 2004-2013 Canonical, Inc. / NASL script (C) 2006-2013 Tenable Network Security, Inc.


Synopsis :

The remote Ubuntu host is missing one or more security-related patches.

Description :

Martin Schulze and Steve Grubb discovered a flaw in the authentication
input validation of the 'chfn' and 'chsh' programs. This allowed
logged in users with an expired password to change their real name and
their login shell without having to change their password.

This flaw cannot lead to privilege escalation and does not allow to
modify account properties of other users, so the impact is relatively
low.

Solution :

Update the affected login and / or passwd packages.

Risk factor :

Medium / CVSS Base Score : 4.6
(CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:P)

Family: Ubuntu Local Security Checks

Nessus Plugin ID: 20576 ()

Bugtraq ID:

CVE ID: CVE-2004-1001