In Shadow 4.13, it is possible to inject control characters into fields provided to the SUID program chfn (change finger). Although it is not possible to exploit this directly (e.g., adding a new user fails because \n is in the block list), it is possible to misrepresent the /etc/passwd file when viewed. Use of \r manipulations and Unicode characters to work around blocking of the : character make it possible to give the impression that a new user has been added. In other words, an adversary may be able to convince a system administrator to take the system offline (an indirect, social-engineered denial of service) by demonstrating that "cat /etc/passwd" shows a rogue user account.

In Shadow 4.13, it is possible to inject control characters into fields provided to the SUID program chfn (change finger). Although it is not possible to exploit this directly (e.g., adding a new user fails because \n is in the block list), it is possible to misrepresent the /etc/passwd file when viewed. Use of \r manipulations and Unicode characters to work around blocking of the : character make it possible to give the impression that a new user has been added. In other words, an adversary may be able to convince a system administrator to take the system offline (an indirect, social-engineered denial of service) by demonstrating that cat /etc/passwd shows a rogue user account.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:0065 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2023-29383:
    In Shadow 4.13, it is possible to inject control characters into fields provided to the SUID program chfn     (change finger). Although it is not possible to exploit this directly (e.g., adding a new user fails     because /n is in the block list), it is possible to misrepresent the /etc/passwd file when viewed. Use of     /r manipulations and Unicode characters to work around blocking of the : character make it possible to     give the impression that a new user has been added. In other words, an adversary may be able to convince a     system administrator to take the system offline (an indirect, social-engineered denial of service) by     demonstrating that cat /etc/passwd shows a rogue user account.

    CVE-2023-4641:
    A flaw was found in shadow-utils. When asking for a new password, shadow-utils asks the password twice. If     the password fails on the second attempt, shadow-utils fails in cleaning the buffer used to store the     first entry. This may allow an attacker with enough access to retrieve the password from the memory.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4130 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4130-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                      Sylvain Beucler     April 18, 2025                                https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : shadow     Version        : 1:4.8.1-1+deb11u1     CVE ID         : CVE-2023-4641 CVE-2023-29383     Debian Bug     : 1034482 1051062

    Several vulnerabilities were discovered in the shadow suite of login     tools. An attacker may extract a password from memory in limited     situations, and confuse an administrator inspecting /etc/passwd from     within a terminal.

    CVE-2023-4641

        When asking for a new password, shadow-utils asks the password         twice. If the password fails on the second attempt, shadow-utils         fails in cleaning the buffer used to store the first entry. This         may allow an attacker with enough access to retrieve the password         from the memory.

    CVE-2023-29383

        It is possible to inject control characters into fields provided         to the SUID program chfn (change finger). Although it is not         possible to exploit this directly (e.g., adding a new user fails         because \n is in the block list), it is possible to misrepresent         the /etc/passwd file when viewed.

    For Debian 11 bullseye, these problems have been fixed in version     1:4.8.1-1+deb11u1.

    We recommend that you upgrade your shadow packages.

    For the detailed security status of shadow please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/shadow

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In Shadow 4.13, it is possible to inject control characters into fields provided to the SUID program chfn     (change finger). Although it is not possible to exploit this directly (e.g., adding a new user fails     because \n is in the block list), it is possible to misrepresent the /etc/passwd file when viewed. Use of     \r manipulations and Unicode characters to work around blocking of the : character make it possible to     give the impression that a new user has been added. In other words, an adversary may be able to convince a     system administrator to take the system offline (an indirect, social-engineered denial of service) by     demonstrating that cat /etc/passwd shows a rogue user account. (CVE-2023-29383)

Note that Nessus relies on the presence of the package as reported by the vendor.

An update of the shadow package has been released.

According to the versions of the shadow package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In Shadow 4.13, it is possible to inject control characters into fields provided to the SUID program chfn     (change finger). Although it is not possible to exploit this directly (e.g., adding a new user fails     because \n is in the block list), it is possible to misrepresent the /etc/passwd file when viewed. Use of     \r manipulations and Unicode characters to work around blocking of the : character make it possible to     give the impression that a new user has been added. In other words, an adversary may be able to convince a     system administrator to take the system offline (an indirect, social-engineered denial of service) by     demonstrating that 'cat /etc/passwd' shows a rogue user account. (CVE-2023-29383)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the shadow package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - In Shadow 4.13, it is possible to inject control characters into fields provided to the SUID program chfn     (change finger). Although it is not possible to exploit this directly (e.g., adding a new user fails     because \n is in the block list), it is possible to misrepresent the /etc/passwd file when viewed. Use of     \r manipulations and Unicode characters to work around blocking of the : character make it possible to     give the impression that a new user has been added. In other words, an adversary may be able to convince a     system administrator to take the system offline (an indirect, social-engineered denial of service) by     demonstrating that 'cat /etc/passwd' shows a rogue user account. (CVE-2023-29383)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:2066-1 advisory.

  - In Shadow 4.13, it is possible to inject control characters into fields provided to the SUID program chfn     (change finger). Although it is not possible to exploit this directly (e.g., adding a new user fails     because  is in the block list), it is possible to misrepresent the /etc/passwd file when viewed. Use of     \r manipulations and Unicode characters to work around blocking of the : character make it possible to     give the impression that a new user has been added. In other words, an adversary may be able to convince a     system administrator to take the system offline (an indirect, social-engineered denial of service) by     demonstrating that cat /etc/passwd shows a rogue user account. (CVE-2023-29383)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2023:2067-1 advisory.

  - In Shadow 4.13, it is possible to inject control characters into fields provided to the SUID program chfn     (change finger). Although it is not possible to exploit this directly (e.g., adding a new user fails     because  is in the block list), it is possible to misrepresent the /etc/passwd file when viewed. Use of     \r manipulations and Unicode characters to work around blocking of the : character make it possible to     give the impression that a new user has been added. In other words, an adversary may be able to convince a     system administrator to take the system offline (an indirect, social-engineered denial of service) by     demonstrating that cat /etc/passwd shows a rogue user account. (CVE-2023-29383)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2023:2068-1 advisory.

  - In Shadow 4.13, it is possible to inject control characters into fields provided to the SUID program chfn     (change finger). Although it is not possible to exploit this directly (e.g., adding a new user fails     because  is in the block list), it is possible to misrepresent the /etc/passwd file when viewed. Use of     \r manipulations and Unicode characters to work around blocking of the : character make it possible to     give the impression that a new user has been added. In other words, an adversary may be able to convince a     system administrator to take the system offline (an indirect, social-engineered denial of service) by     demonstrating that cat /etc/passwd shows a rogue user account. (CVE-2023-29383)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:2070-1 advisory.

  - In Shadow 4.13, it is possible to inject control characters into fields provided to the SUID program chfn     (change finger). Although it is not possible to exploit this directly (e.g., adding a new user fails     because  is in the block list), it is possible to misrepresent the /etc/passwd file when viewed. Use of     \r manipulations and Unicode characters to work around blocking of the : character make it possible to     give the impression that a new user has been added. In other words, an adversary may be able to convince a     system administrator to take the system offline (an indirect, social-engineered denial of service) by     demonstrating that cat /etc/passwd shows a rogue user account. (CVE-2023-29383)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2023:2069-1 advisory.

  - In Shadow 4.13, it is possible to inject control characters into fields provided to the SUID program chfn     (change finger). Although it is not possible to exploit this directly (e.g., adding a new user fails     because  is in the block list), it is possible to misrepresent the /etc/passwd file when viewed. Use of     \r manipulations and Unicode characters to work around blocking of the : character make it possible to     give the impression that a new user has been added. In other words, an adversary may be able to convince a     system administrator to take the system offline (an indirect, social-engineered denial of service) by     demonstrating that cat /etc/passwd shows a rogue user account. (CVE-2023-29383)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
504259	Siemens SIMATIC S7-1500 Improper Neutralization of Special Elements in Output Used by a Downstream Component (CVE-2023-29383)	Tenable OT Security	Tenable.ot	low
239112	TencentOS Server 4: shadow-utils (TSSA-2025:0065)	Nessus	Tencent Local Security Checks	medium
234692	Debian dla-4130 : login - security update	Nessus	Debian Local Security Checks	medium
226022	Linux Distros Unpatched Vulnerability : CVE-2023-29383	Nessus	Misc.	low
204294	Photon OS 5.0: Shadow PHSA-2024-5.0-0182	Nessus	PhotonOS Local Security Checks	medium
203245	Photon OS 4.0: Shadow PHSA-2023-4.0-0399	Nessus	PhotonOS Local Security Checks	low
188691	EulerOS 2.0 SP11 : shadow (EulerOS-SA-2023-2710)	Nessus	Huawei Local Security Checks	low
188366	EulerOS Virtualization 2.11.1 : shadow (EulerOS-SA-2023-2742)	Nessus	Huawei Local Security Checks	low
188278	EulerOS 2.0 SP11 : shadow (EulerOS-SA-2023-2668)	Nessus	Huawei Local Security Checks	low
188250	EulerOS Virtualization 2.11.0 : shadow (EulerOS-SA-2023-2773)	Nessus	Huawei Local Security Checks	low
179260	EulerOS Virtualization 2.10.1 : shadow (EulerOS-SA-2023-2549)	Nessus	Huawei Local Security Checks	low
179255	EulerOS Virtualization 2.10.0 : shadow (EulerOS-SA-2023-2568)	Nessus	Huawei Local Security Checks	low
179107	EulerOS Virtualization 2.9.1 : shadow (EulerOS-SA-2023-2519)	Nessus	Huawei Local Security Checks	low
179088	EulerOS Virtualization 2.9.0 : shadow (EulerOS-SA-2023-2532)	Nessus	Huawei Local Security Checks	low
178372	EulerOS 2.0 SP10 : shadow (EulerOS-SA-2023-2368)	Nessus	Huawei Local Security Checks	low
178344	EulerOS 2.0 SP10 : shadow (EulerOS-SA-2023-2394)	Nessus	Huawei Local Security Checks	low
178094	EulerOS 2.0 SP9 : shadow (EulerOS-SA-2023-2343)	Nessus	Huawei Local Security Checks	low
178070	EulerOS 2.0 SP9 : shadow (EulerOS-SA-2023-2323)	Nessus	Huawei Local Security Checks	low
174949	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : shadow (SUSE-SU-2023:2066-1)	Nessus	SuSE Local Security Checks	low
174946	SUSE SLES12 Security Update : shadow (SUSE-SU-2023:2067-1)	Nessus	SuSE Local Security Checks	low
174945	SUSE SLES15 Security Update : shadow (SUSE-SU-2023:2068-1)	Nessus	SuSE Local Security Checks	low
174943	SUSE SLES15 Security Update : shadow (SUSE-SU-2023:2070-1)	Nessus	SuSE Local Security Checks	low
174941	SUSE SLES12 Security Update : shadow (SUSE-SU-2023:2069-1)	Nessus	SuSE Local Security Checks	low

Detections

Analytics

CVE-2023-29383

low

Tenable Plugins

low

medium

medium

low

medium

low

low

low

low

low

low

low

low

low

low

low

low

low

low

low

low

low

low