RHEL 2.1 : util-linux (RHSA-2002:137)

Medium Nessus Plugin ID 12311


The remote Red Hat host is missing a security update.


The util-linux package shipped with Red Hat Linux Advanced Server contains a locally exploitable vulnerability.

The util-linux package contains a large variety of low-level system utilities that are necessary for a Linux system to function. The 'chfn' utility included in this package allows users to modify personal information stored in the system-wide password file, /etc/passwd. In order to modify this file, this application is installed setuid root.

Under certain conditions, a carefully crafted attack sequence can be performed to exploit a complex file locking and modification race present in this utility allowing changes to be made to /etc/passwd.

In order to successfully exploit the vulnerability and perform privilege escalation there is a need for a minimal administrator interaction. Additionally, the password file must be over 4 kilobytes, and the local attackers entry must not be in the last 4 kilobytes of the password file.

The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2002-0638 to this issue.

An interim workaround is to remove setuid flags from /usr/bin/chfn and /usr/bin/chsh. All users of Red Hat Linux should update to the errata util-linux packages which contain a patch to correct this vulnerability.

Many thanks to Michal Zalewski of Bindview for alerting us to this issue.


Update the affected util-linux package.

See Also




Plugin Details

Severity: Medium

ID: 12311

File Name: redhat-RHSA-2002-137.nasl

Version: $Revision: 1.19 $

Type: local

Agent: unix

Published: 2004/07/06

Modified: 2016/12/28

Dependencies: 12634

Risk Information

Risk Factor: Medium


Base Score: 6.2

Vector: CVSS2#AV:L/AC:H/Au:N/C:C/I:C/A:C

Vulnerability Information

CPE: p-cpe:/a:redhat:enterprise_linux:util-linux, cpe:/o:redhat:enterprise_linux:2.1

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/cpu

Patch Publication Date: 2002/07/29

Vulnerability Publication Date: 2002/07/29

Reference Information

CVE: CVE-2002-0638

OSVDB: 5164

CERT: 405955

RHSA: 2002:137