[ GLSA 200411-09 ] shadow: Unauthorized modification of account information

[Matthias Geerdsen]

This is an OpenPGP/MIME signed message (RFC 2440 and 3156)
--------------enig497BD2360716B3555A547F98
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200411-09
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: Low
Title: shadow: Unauthorized modification of account information
Date: November 04, 2004
Bugs: #69212
ID: 200411-09

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

A flaw in the chfn and chsh utilities might allow modification of
account properties by unauthorized users.

Background
==========

shadow provides a set of utilities to deal with user accounts.

Affected packages
=================

-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 sys-apps/shadow < 4.0.5-r1 >= 4.0.5-r1

Description
===========

Martin Schulze reported a flaw in the passwd_check() function in
"libmisc/pwdcheck.c" which is used by chfn and chsh.

Impact
======

A local attacker may be able to use chfn and chsh to change the
standard shell of other users or modify their GECOS information (full
name, phone number...).

Workaround
==========

There is no known workaround at this time.

Resolution
==========

All shadow users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=sys-apps/shadow-4.0.5-r1"

References
==========

[ 1 ] shadow NEWS file
http://ftp.pld.org.pl/software/shadow/NEWS

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-200411-09.xml

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
http://bugs.gentoo.org.

License
=======

Copyright 2004 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/1.0

--------------enig497BD2360716B3555A547F98
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.6 (GNU/Linux)

iD8DBQFBio+GGc/RGrFqUYMRAvddAJ4sihplCkaiOMFwnHBq5kfMWbCYvACcD/r+
pY2CLml9T6CG44llMZjWaQg=
=ax34
-----END PGP SIGNATURE-----

--------------enig497BD2360716B3555A547F98--

[Solar Designer]

On Thu, Nov 04, 2004 at 09:22:24PM +0100, Matthias Geerdsen wrote:
> Severity: Low
> Title: shadow: Unauthorized modification of account information
[...]
> A flaw in the chfn and chsh utilities might allow modification of
> account properties by unauthorized users.
[...]
> A local attacker may be able to use chfn and chsh to change the
> standard shell of other users or modify their GECOS information (full
> name, phone number...).

While you did correctly categorize this as "low" severity, the above
description is not correct. It is not possible to use this on other
users' accounts. Here's the description from Owl change log:

2004/06/09 Package: shadow-utils
SECURITY FIX Severity: none to low, local, active
Properly check the return value from pam_chauthtok(3) in chfn(1) and
chsh(1). Previously, if chfn and/or chsh commands would be enabled
for non-privileged users with control(8), it would have been possible
for a logged in user with an expired password to change their "Full
Name" and login shell without having to change the password. Thanks
to Steve Grubb and Martin Schulze for discovering this problem.

The only bug here is that chfn/chsh did not properly force a change of
an expired password, yet permitted the requested change of GECOS info
or login shell to be performed. This is hardly worth an advisory. In
fact, it might not have been worth our change log entry either...

--
Alexander Peslyak <solar at openwall.com>
GPG key ID: B35D3598 fp: 6429 0D7E F130 C13E C929 6447 73C3 A290 B35D 3598
http://www.openwall.com - bringing security into open computing environments