Unknown vulnerability in the passwd_check function in Shadow 4.0.4.1, and possibly other versions before 4.0.5, allows local users to conduct unauthorized activities when an error from a pam_chauthtok function call is not properly handled.

Martin Schulze and Steve Grubb discovered a flaw in the authentication input validation of the 'chfn' and 'chsh' programs. This allowed logged in users with an expired password to change their real name and their login shell without having to change their password.

This flaw cannot lead to privilege escalation and does not allow to modify account properties of other users, so the impact is relatively low.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A vulnerability has been discovered in the shadow suite which provides programs like chfn and chsh. It is possible for a user, who is logged in but has an expired password to alter his account information with chfn or chsh without having to change the password. The problem was originally thought to be more severe.

A vulnerability in the shadow suite was discovered by Martin Schulze that can be exploited by local users to bypass certain security restrictions due to an input validation error in the passwd_check() function. This function is used by the chfn and chsh tools.

The updated packages have been patched to prevent this problem.

The remote host is affected by the vulnerability described in GLSA-200411-09 (shadow: Unauthorized modification of account information)

    Martin Schulze reported a flaw in the passwd_check() function in     'libmisc/pwdcheck.c' which is used by chfn and chsh.
  Impact :

    A logged-in local user with an expired password may be able to use chfn and     chsh to change his standard shell or GECOS information (full name, phone     number...) without being required to change his password.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
20576	Ubuntu 4.10 : passwd vulnerabilities (USN-17-1)	Nessus	Ubuntu Local Security Checks	medium
15683	Debian DSA-585-1 : shadow - programming error	Nessus	Debian Local Security Checks	medium
15637	Mandrake Linux Security Advisory : shadow-utils (MDKSA-2004:126)	Nessus	Mandriva Local Security Checks	medium
15634	GLSA-200411-09 : shadow: Unauthorized modification of account information	Nessus	Gentoo Local Security Checks	medium

Detections

Analytics

CVE-2004-1001

high

Tenable Plugins

medium

medium

medium

medium