shadow: Unauthorized modification of account information

Security Team Contact Address

Updated November 04, 2004

1. Gentoo Linux Security Advisory

Advisory Reference	GLSA 200411-09 / shadow
Release Date	November 04, 2004
Latest Revision	November 05, 2004: 02
Impact	low
Exploitable	local

Package	Vulnerable versions	Unaffected versions	Architecture(s)
sys-apps/shadow	< 4.0.5-r1	>= 4.0.5-r1	All supported architectures

Related bugreports: #69212

Synopsis

A flaw in the chfn and chsh utilities might allow modification of account properties by unauthorized users.

2. Impact Information

Background

shadow provides a set of utilities to deal with user accounts.

Description

Martin Schulze reported a flaw in the passwd_check() function in "libmisc/pwdcheck.c" which is used by chfn and chsh.

Impact

A logged-in local user with an expired password may be able to use chfn and chsh to change his standard shell or GECOS information (full name, phone number...) without being required to change his password.

3. Resolution Information

Workaround

There is no known workaround at this time.

Resolution

All shadow users should upgrade to the latest version:

Code Listing 3.1: Resolution

# emerge --sync
# emerge --ask --oneshot --verbose ">=sys-apps/shadow-4.0.5-r1"

4. References