This update for shadow fixes several issues.

This security issue was fixed :

  - CVE-2017-12424: The newusers tool could have been forced     to manipulate internal data structures in ways     unintended by the authors. Malformed input may have lead     to crashes (with a buffer overflow or other memory     corruption) or other unspecified behaviors     (bsc#1052261).

These non-security issues were fixed :

  - bsc#1023895: Fixed man page to not contain invalid     options and also prevent warnings when using these     options in certain settings

  - bsc#980486: Reset user in /var/log/tallylog because of     the usage of pam_tally2

This update was imported from the SUSE:SLE-12-SP2:Update update project.

The remote host is affected by the vulnerability described in GLSA-201710-16 (Shadow: Buffer overflow)

    Malformed input in the newusers tool may produce crashes and other       unspecified behaviors.
  Impact :

    A remote attacker could possibly cause a Denial of Service condition or       bypass privilege boundaries in some web-hosting environments in which a       Control Panel allows an unprivileged user account to create subaccounts.
  Workaround :

    There is no known workaround at this time.

Several vulnerabilities were discovered in the shadow suite of login tools. An attacker may escalate privileges in specific configurations.

CVE-2017-20002

Shadow incorrectly lists pts/0 and pts/1 as physical terminals in /etc/securetty. This allows local users to login as password-less users even if they are connected by non-physical means such as SSH (hence bypassing PAM's nullok_secure configuration). This notably affects environments such as virtual machines automatically generated with a default blank root password, allowing all local users to escalate privileges. It should be noted however that /etc/securetty will be dropped in Debian 11/bullseye.

CVE-2017-12424

The newusers tool could be made to manipulate internal data structures in ways unintended by the authors. Malformed input may lead to crashes (with a buffer overflow or other memory corruption) or other unspecified behaviors. This crosses a privilege boundary in, for example, certain web-hosting environments in which a Control Panel allows an unprivileged user account to create subaccounts.

For Debian 9 stretch, these problems have been fixed in version 1:4.4-4.1+deb9u1.

We recommend that you upgrade your shadow packages.

For the detailed security status of shadow please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/shadow

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the shadow-utils package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In shadow before 4.5, the newusers tool could be made     to manipulate internal data structures in ways     unintended by the authors. Malformed input may lead to     crashes (with a buffer overflow or other memory     corruption) or other unspecified behaviors. This     crosses a privilege boundary in, for example, certain     web-hosting environments in which a Control Panel     allows an unprivileged user account to create     subaccounts.(CVE-2017-12424)

  - Integer overflow in shadow 4.2.1 allows local users to     gain privileges via crafted input to     newuidmap.(CVE-2016-6252)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the shadow-utils package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - A buffer overflow flaw leading to heap memory     corruption was found in the shadow-utils's newusers     utility. A local, authenticated attacker could     potentially use this flaw to crash the newusers process     by supplying crafted data to it.(CVE-2017-12424)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the shadow package has been released.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5254-1 advisory.

  - In shadow before 4.5, the newusers tool could be made to manipulate internal data structures in ways     unintended by the authors. Malformed input may lead to crashes (with a buffer overflow or other memory     corruption) or other unspecified behaviors. This crosses a privilege boundary in, for example, certain     web-hosting environments in which a Control Panel allows an unprivileged user account to create     subaccounts. (CVE-2017-12424)

  - An issue was discovered in shadow 4.5. newgidmap (in shadow-utils) is setuid and allows an unprivileged     user to be placed in a user namespace where setgroups(2) is permitted. This allows an attacker to remove     themselves from a supplementary group, which may allow access to certain filesystem paths if the     administrator has used group blacklisting (e.g., chmod g-rwx) to restrict access to paths. This flaw     effectively reverts a security feature in the kernel (in particular, the /proc/self/setgroups knob) to     prevent this sort of privilege escalation. (CVE-2018-7169)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for shadow fixes several issues. This security issue was fixed :

  - CVE-2017-12424: The newusers tool could have been forced     to manipulate internal data structures in ways     unintended by the authors. Malformed input may have lead     to crashes (with a buffer overflow or other memory     corruption) or other unspecified behaviors     (bsc#1052261).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
104523	openSUSE Security Update : shadow (openSUSE-2017-1265)	Nessus	SuSE Local Security Checks	11/13/2017	1/19/2021	critical
103851	GLSA-201710-16 : Shadow: Buffer overflow	Nessus	Gentoo Local Security Checks	10/16/2017	1/11/2021	critical
147813	Debian DLA-2596-1 : shadow security update	Nessus	Debian Local Security Checks	3/16/2021	1/12/2024	critical
131581	EulerOS 2.0 SP2 : shadow-utils (EulerOS-SA-2019-2427)	Nessus	Huawei Local Security Checks	12/4/2019	4/8/2024	critical
110745	EulerOS 2.0 SP3 : shadow-utils (EulerOS-SA-2018-1169)	Nessus	Huawei Local Security Checks	6/28/2018	1/6/2021	critical
121727	Photon OS 1.0: Shadow PHSA-2017-0030	Nessus	PhotonOS Local Security Checks	2/7/2019	2/7/2019	critical
157160	Ubuntu 16.04 ESM / 18.04 LTS : shadow vulnerabilities (USN-5254-1)	Nessus	Ubuntu Local Security Checks	1/27/2022	10/16/2023	critical
104472	SUSE SLED12 / SLES12 Security Update : shadow (SUSE-SU-2017:2947-1)	Nessus	SuSE Local Security Checks	11/9/2017	1/6/2021	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical

critical

critical