Shadow-Utils 'useradd' Local Insecure Permissions Vulnerability
BID:18111
Info
Shadow-Utils 'useradd' Local Insecure Permissions Vulnerability
| Bugtraq ID: | 18111 |
| Class: | Race Condition Error |
| CVE: |
CVE-2006-1174 |
| Remote: | No |
| Local: | Yes |
| Published: | May 24 2006 12:00AM |
| Updated: | Dec 18 2007 08:04PM |
| Credit: | Koblinger Egmont <[email protected]> discovered this issue. |
| Vulnerable: |
VMWare ESX Server 3.0.2 VMWare ESX Server 3.0.1 VMWare ESX Server 3.0 shadow shadow 4.0.8 shadow shadow 4.0.3 SGI ProPack 3.0 SP6 rPath rPath Linux 1 Redhat Enterprise Linux WS 4 Redhat Enterprise Linux WS 3 Redhat Enterprise Linux ES 4 Redhat Enterprise Linux ES 3 Redhat Enterprise Linux AS 4 Redhat Enterprise Linux AS 3 Redhat Desktop 4.0 Redhat Desktop 3.0 Mandriva Linux Mandrake 10.2 x86_64 Mandriva Linux Mandrake 10.2 MandrakeSoft Multi Network Firewall 2.0 MandrakeSoft Corporate Server 3.0 x86_64 MandrakeSoft Corporate Server 3.0 Gentoo Linux Avaya SES 3.1.1 Avaya Messaging Storage Server MSS 3.0 Avaya Message Networking MN 3.1 Avaya EMMC 1.021 Avaya EMMC 1.017 Avaya EMMC 0 Avaya Communication Manager 2.0.1 Avaya Communication Manager 2.0 Avaya Communication Manager 4.0 Avaya Communication Manager 3.1 Avaya Communication Manager 3.0 Avaya CCS 3.1.1 Avaya Aura Application Enablement Services 3.1.3 Avaya Aura Application Enablement Services 3.0 Avaya AES 4.0 Avaya AES 3.1 |
| Not Vulnerable: | |
Discussion
Shadow-Utils 'useradd' Local Insecure Permissions Vulnerability
The 'useradd' utility in shadow-utils is prone to a local insecure-permissions vulnerability. This issue is due to a race-condition between when user mailboxes are created and when permissions are set on the file.
A local, unprivileged attacker can exploit this issue to gain access to newly created mailbox files. This may allow them to directly inject forged email messages to aid them in social-engineering attacks. Attackers may also be able to inject data into the mailbox file that will cause mail applications to fail to access the file, denying email access to targeted users. Other attacks may also be possible.
This issue affects shadow-utils 4.0.3; other versions may also be affected.
The 'useradd' utility in shadow-utils is prone to a local insecure-permissions vulnerability. This issue is due to a race-condition between when user mailboxes are created and when permissions are set on the file.
A local, unprivileged attacker can exploit this issue to gain access to newly created mailbox files. This may allow them to directly inject forged email messages to aid them in social-engineering attacks. Attackers may also be able to inject data into the mailbox file that will cause mail applications to fail to access the file, denying email access to targeted users. Other attacks may also be possible.
This issue affects shadow-utils 4.0.3; other versions may also be affected.
Exploit / POC
Shadow-Utils 'useradd' Local Insecure Permissions Vulnerability
Attackers use standard system utilities to exploit this issue.
Attackers use standard system utilities to exploit this issue.
Solution / Fix
Shadow-Utils 'useradd' Local Insecure Permissions Vulnerability
Solution:
The vendor has released version 4.0.8 to address this issue.
Please see the referenced advisories for information on obtaining and applying fixes.
SGI ProPack 3.0 SP6
shadow shadow 4.0.3
Solution:
The vendor has released version 4.0.8 to address this issue.
Please see the referenced advisories for information on obtaining and applying fixes.
SGI ProPack 3.0 SP6
-
SGI Patch 10421
ftp://oss.sgi.com/projects/sgi_propack/download/
shadow shadow 4.0.3
-
shadow shadow-4.0.8.tar.bz2
ftp://ftp.pld.org.pl/software/shadow/old/shadow-4.0.8.tar.bz2
References
Shadow-Utils 'useradd' Local Insecure Permissions Vulnerability
References:
References:
- ASA-2007-249 - shadow-utils security and bug fix update (Avaya)
- CVS log for shadow/src/useradd.c (shadow)
- useradd patch (shadow)
- ASA-2007-326 shadow-utils security and bug fix update (RHSA-2007-0431) (Avaya)
- RHSA-2007:0276 shadow-utils security and bug fix update (Red Hat)
- RHSA-2007:0431-4 shadow-utils security and bug fix update (Red Hat)
- Vulnerability Note VU#312692 Shadow Utils useradd utility sets incorrect file pe (US-CERT)