[Security-team] [Fwd: [SA20950] shadow setuid Vulnerability]

[Alexey Borovskoy]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

TITLE:
shadow setuid Vulnerability

SECUNIA ADVISORY ID:
SA20950

VERIFY ADVISORY:
http://secunia.com/advisories/20950/

CRITICAL:
Less critical

IMPACT:
Privilege escalation

WHERE:
Local system

SOFTWARE:
Shadow 4.x
http://secunia.com/product/4190/

DESCRIPTION:
Ilja van Sprundel reported a vulnerability in the passwd application
of shadow, which potentially can be exploited by malicious, local
users to perform certain actions with escalated privileges.

The vulnerability is due to missing checks in passwd for whether the
"setuid()" call has succeeded, when started with the -f, -g, or -s
option. This can potentially be exploited to launch chfn, chsh, or
gpasswd with root privileges, which may allow the user to perform
certain actions as the root user.

Successful exploitation allows to perform certain actions with
escalated privileges, but requires that PAM is configured with a
maximum number of user processes.

This vulnerability was reported in version 4.0.3 and 4.0.13. Prior
versions may be also affected.

SOLUTION:
Update to version 4.0.14 or later.
ftp://ftp.pld.org.pl/software/shadow/

PROVIDED AND/OR DISCOVERED BY:
Ilja van Sprundel

ORIGINAL ADVISORY:
http://www.ubuntu.com/usn/usn-308-1

- --
Алексей.
GPG key fingerprint
949B BC0E 2C44 7528 4F63  2753 E37A 9E3F 11F3 BDE1
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.5 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFEr1hX43qePxHzveERAmy/AJ9s7ibLqRgKKWFX7Isr8D0t33FBgQCbBJNl
R09Db8+w7my6paJeK2fgmDM=
=WhDR
-----END PGP SIGNATURE-----