Detections
Analytics

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: shadow (UTSA-2023-001594)

low Nessus Plugin ID 345497

Synopsis

The Unity Linux host is missing one or more security updates.

Description

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-001594 advisory.

 In Shadow 4.13, it is possible to inject control characters into fields provided to the SUID program chfn (change finger). Although it is not possible to exploit this directly (e.g., adding a new user fails because \n is in the block list), it is possible to misrepresent the /etc/passwd file when viewed. Use of \r manipulations and Unicode characters to work around blocking of the : character make it possible to give the impression that a new user has been added. In other words, an adversary may be able to convince a system administrator to take the system offline (an indirect, social-engineered denial of service) by demonstrating that cat /etc/passwd shows a rogue user account.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected shadow package.

See Also

https://gitee.com/src-openeuler/shadow/issues/I6VYD4

https://nvd.nist.gov/vuln/detail/CVE-2023-29383

http://www.nessus.org/u?ec51b291

Plugin Details

Severity: Low

ID: 345497

File Name: unity_linux_UTSA-2023-001594.nasl

Version: 1.1

Type: Local

Published: 9/13/2026

Updated: 9/13/2026

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Low

Score: 1.2

Percentile: 0.01

CVSS v2

Risk Factor: Low

Base Score: 1.7

Temporal Score: 1.3

Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:P/A:N

CVSS Score Source: CVE-2023-29383

CVSS v3

Risk Factor: Low

Base Score: 3.3

Temporal Score: 3

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Required KB Items: Host/local_checks_enabled, Host/UOS-Server/release, Host/UOS-Server/rpm-list, Host/cpu

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 6/2/2023

Vulnerability Publication Date: 4/14/2023

Reference Information

CVE: CVE-2023-29383