/bin/login in shadow 4.0.18.1 in Debian GNU/Linux, and probably other Linux distributions, allows local users in the utmp group to overwrite arbitrary files via a symlink attack on a temporary file referenced in a line (aka ut_line) field in a utmp entry.

Paul Szabo discovered a race condition in login. While setting up tty permissions, login did not correctly handle symlinks. If a local attacker were able to gain control of the system utmp file, they could cause login to change the ownership and permissions on arbitrary files, leading to a root privilege escalation.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A security vulnerability has been identified and fixed in login application from shadow-utils, which could allow local users in the utmp group to overwrite arbitrary files via a symlink attack on a temporary file referenced in a line (aka ut_line) field in a utmp entry (CVE-2008-5394).

The updated packages have been patched to prevent this.

Note: Mandriva Linux is using login application from util-linux-ng by default, and therefore is not affected by this issue on default configuration.

The remote host is affected by the vulnerability described in GLSA-200903-24 (Shadow: Privilege escalation)

    Paul Szabo reported a race condition in the 'login' executable when     setting up tty permissions.
  Impact :

    A local attacker belonging to the 'utmp' group could use symlink     attacks to overwrite arbitrary files and possibly gain root privileges.
  Workaround :

    There is no known workaround at this time.

Paul Szabo discovered that login, the system login tool, did not correctly handle symlinks while setting up tty permissions. If a local attacker were able to gain control of the system utmp file, they could cause login to change the ownership and permissions on arbitrary files, leading to a root privilege escalation.

ID	Name	Product	Family	Severity
37654	Ubuntu 6.06 LTS / 7.10 / 8.04 LTS / 8.10 : shadow vulnerability (USN-695-1)	Nessus	Ubuntu Local Security Checks	high
36812	Mandriva Linux Security Advisory : shadow-utils (MDVSA-2009:062)	Nessus	Mandriva Local Security Checks	high
35905	GLSA-200903-24 : Shadow: Privilege escalation	Nessus	Gentoo Local Security Checks	high
35431	Debian DSA-1709-1 : shadow - race condition	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2008-5394

medium

Tenable Plugins

high

high

high

high