Multiple Linux Distributions 'login' Local Privilege Escalation Vulnerability

Bugtraq ID:	32552
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2008-5394
Remote:	No
Local:	Yes
Published:	Nov 09 2008 12:00AM
Updated:	Mar 10 2009 11:06PM
Credit:	Paul Szabo
Vulnerable:	Ubuntu Ubuntu Linux 8.10 sparc Ubuntu Ubuntu Linux 8.10 powerpc Ubuntu Ubuntu Linux 8.10 lpia Ubuntu Ubuntu Linux 8.10 i386 Ubuntu Ubuntu Linux 8.10 amd64 Ubuntu Ubuntu Linux 8.04 LTS sparc Ubuntu Ubuntu Linux 8.04 LTS powerpc Ubuntu Ubuntu Linux 8.04 LTS lpia Ubuntu Ubuntu Linux 8.04 LTS i386 Ubuntu Ubuntu Linux 8.04 LTS amd64 Ubuntu Ubuntu Linux 7.10 sparc Ubuntu Ubuntu Linux 7.10 powerpc Ubuntu Ubuntu Linux 7.10 lpia Ubuntu Ubuntu Linux 7.10 i386 Ubuntu Ubuntu Linux 7.10 amd64 Ubuntu Ubuntu Linux 7.04 sparc Ubuntu Ubuntu Linux 7.04 powerpc Ubuntu Ubuntu Linux 7.04 i386 Ubuntu Ubuntu Linux 7.04 amd64 Ubuntu Ubuntu Linux 6.06 LTS sparc Ubuntu Ubuntu Linux 6.06 LTS powerpc Ubuntu Ubuntu Linux 6.06 LTS i386 Ubuntu Ubuntu Linux 6.06 LTS amd64 Mandriva Linux Mandrake 2009.0 x86_64 Mandriva Linux Mandrake 2009.0 Mandriva Linux Mandrake 2008.1 x86_64 Mandriva Linux Mandrake 2008.1 Mandriva Linux Mandrake 2008.0 x86_64 Mandriva Linux Mandrake 2008.0 MandrakeSoft Multi Network Firewall 2.0 MandrakeSoft Corporate Server 4.0 x86_64 MandrakeSoft Corporate Server 3.0 x86_64 MandrakeSoft Corporate Server 3.0 MandrakeSoft Corporate Server 4.0 Gentoo Linux Debian Linux 3.1 sparc Debian Linux 3.1 s/390 Debian Linux 3.1 ppc Debian Linux 3.1 mipsel Debian Linux 3.1 mips Debian Linux 3.1 m68k Debian Linux 3.1 ia-64 Debian Linux 3.1 ia-32 Debian Linux 3.1 hppa Debian Linux 3.1 arm Debian Linux 3.1 amd64 Debian Linux 3.1 alpha Debian Linux 3.1 Debian Linux 3.0 sparc Debian Linux 3.0 s/390 Debian Linux 3.0 ppc Debian Linux 3.0 mipsel Debian Linux 3.0 mips Debian Linux 3.0 m68k Debian Linux 3.0 ia-64 Debian Linux 3.0 ia-32 Debian Linux 3.0 hppa Debian Linux 3.0 arm Debian Linux 3.0 alpha Debian Linux 3.0 Debian Linux 4.0 sparc Debian Linux 4.0 s/390 Debian Linux 4.0 powerpc Debian Linux 4.0 mipsel Debian Linux 4.0 mips Debian Linux 4.0 m68k Debian Linux 4.0 ia-64 Debian Linux 4.0 ia-32 Debian Linux 4.0 hppa Debian Linux 4.0 arm Debian Linux 4.0 amd64 Debian Linux 4.0 alpha Debian Linux 4.0
Not Vulnerable:

Multiple Linux Distributions 'login' Local Privilege Escalation Vulnerability

Multiple Linux distributions a local privilege-escalation vulnerability because of an error in the 'login' program.

Local attackers in the UTMP group could exploit this issue to take ownership of arbitrary files on the vulnerable system. This may lead to a complete compromise of the system.

Multiple Linux Distributions 'login' Local Privilege Escalation Vulnerability

The following exploit is available:

• /data/vulnerabilities/exploits/32552.sh

Multiple Linux Distributions 'login' Local Privilege Escalation Vulnerability

Solution:
Updates are available. Please see the references for more information.


Ubuntu Ubuntu Linux 7.10 powerpc

• Ubuntu login_4.0.18.1-9ubuntu0.2_powerpc.deb
  http://security.ubuntu.com/ubuntu/pool/main/s/shadow/login_4.0.18.1-9u buntu0.2_powerpc.deb


• Ubuntu passwd_4.0.18.1-9ubuntu0.2_powerpc.deb
  http://security.ubuntu.com/ubuntu/pool/main/s/shadow/passwd_4.0.18.1-9 ubuntu0.2_powerpc.deb

Ubuntu Ubuntu Linux 8.04 LTS powerpc

• Ubuntu login_4.0.18.2-1ubuntu2.2_powerpc.deb
  http://ports.ubuntu.com/pool/main/s/shadow/login_4.0.18.2-1ubuntu2.2_p owerpc.deb


• Ubuntu passwd_4.0.18.2-1ubuntu2.2_powerpc.deb
  http://ports.ubuntu.com/pool/main/s/shadow/passwd_4.0.18.2-1ubuntu2.2_ powerpc.deb

Ubuntu Ubuntu Linux 8.10 powerpc

• Ubuntu login_4.1.1-1ubuntu1.2_powerpc.deb
  http://ports.ubuntu.com/pool/main/s/shadow/login_4.1.1-1ubuntu1.2_powe rpc.deb


• Ubuntu passwd_4.1.1-1ubuntu1.2_powerpc.deb
  http://ports.ubuntu.com/pool/main/s/shadow/passwd_4.1.1-1ubuntu1.2_pow erpc.deb

Ubuntu Ubuntu Linux 8.04 LTS sparc

• Ubuntu login_4.0.18.2-1ubuntu2.2_sparc.deb
  http://ports.ubuntu.com/pool/main/s/shadow/login_4.0.18.2-1ubuntu2.2_s parc.deb


• Ubuntu passwd_4.0.18.2-1ubuntu2.2_sparc.deb
  http://ports.ubuntu.com/pool/main/s/shadow/passwd_4.0.18.2-1ubuntu2.2_ sparc.deb

Ubuntu Ubuntu Linux 6.06 LTS sparc

• Ubuntu login_4.0.13-7ubuntu3.4_sparc.deb
  http://security.ubuntu.com/ubuntu/pool/main/s/shadow/login_4.0.13-7ubu ntu3.4_sparc.deb


• Ubuntu passwd_4.0.13-7ubuntu3.4_sparc.deb
  http://security.ubuntu.com/ubuntu/pool/main/s/shadow/passwd_4.0.13-7ub untu3.4_sparc.deb

Mandriva Linux Mandrake 2008.0 x86_64

• Mandriva shadow-utils-4.0.12-8.1mdv2008.0.x86_64.rpm
  http://www.mandriva.com/en/download/

Ubuntu Ubuntu Linux 8.04 LTS amd64

• Ubuntu login_4.0.18.2-1ubuntu2.2_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/s/shadow/login_4.0.18.2-1u buntu2.2_amd64.deb


• Ubuntu passwd_4.0.18.2-1ubuntu2.2_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/s/shadow/passwd_4.0.18.2-1 ubuntu2.2_amd64.deb

Mandriva Linux Mandrake 2008.0

• Mandriva shadow-utils-4.0.12-8.1mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/

Ubuntu Ubuntu Linux 7.10 sparc

• Ubuntu login_4.0.18.1-9ubuntu0.2_sparc.deb
  http://security.ubuntu.com/ubuntu/pool/main/s/shadow/login_4.0.18.1-9u buntu0.2_sparc.deb


• Ubuntu passwd_4.0.18.1-9ubuntu0.2_sparc.deb
  http://security.ubuntu.com/ubuntu/pool/main/s/shadow/passwd_4.0.18.1-9 ubuntu0.2_sparc.deb

Debian Linux 4.0 amd64

• Debian login_4.0.18.1-7+etch1_amd64.deb
  http://security.debian.org/pool/updates/main/s/shadow/login_4.0.18.1-7 +etch1_amd64.deb


• Debian passwd_4.0.18.1-7+etch1_amd64.deb
  http://security.debian.org/pool/updates/main/s/shadow/passwd_4.0.18.1- 7+etch1_amd64.deb

Debian Linux 4.0 ia-32

• Debian login_4.0.18.1-7+etch1_i386.deb
  http://security.debian.org/pool/updates/main/s/shadow/login_4.0.18.1-7 +etch1_i386.deb


• Debian passwd_4.0.18.1-7+etch1_i386.deb
  http://security.debian.org/pool/updates/main/s/shadow/passwd_4.0.18.1- 7+etch1_i386.deb

Debian Linux 4.0 hppa

• Debian login_4.0.18.1-7+etch1_hppa.deb
  http://security.debian.org/pool/updates/main/s/shadow/login_4.0.18.1-7 +etch1_hppa.deb


• Debian passwd_4.0.18.1-7+etch1_hppa.deb
  http://security.debian.org/pool/updates/main/s/shadow/passwd_4.0.18.1- 7+etch1_hppa.deb

Ubuntu Ubuntu Linux 8.10 sparc

• Ubuntu login_4.1.1-1ubuntu1.2_sparc.deb
  http://ports.ubuntu.com/pool/main/s/shadow/login_4.1.1-1ubuntu1.2_spar c.deb


• Ubuntu passwd_4.1.1-1ubuntu1.2_sparc.deb
  http://ports.ubuntu.com/pool/main/s/shadow/passwd_4.1.1-1ubuntu1.2_spa rc.deb

Debian Linux 4.0 mipsel

• Debian login_4.0.18.1-7+etch1_mipsel.deb
  http://security.debian.org/pool/updates/main/s/shadow/login_4.0.18.1-7 +etch1_mipsel.deb


• Debian passwd_4.0.18.1-7+etch1_mipsel.deb
  http://security.debian.org/pool/updates/main/s/shadow/passwd_4.0.18.1- 7+etch1_mipsel.deb

Mandriva Linux Mandrake 2009.0 x86_64

• Mandriva shadow-utils-4.0.12-17.1mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/

Ubuntu Ubuntu Linux 8.10 amd64

• Ubuntu login_4.1.1-1ubuntu1.2_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/s/shadow/login_4.1.1-1ubun tu1.2_amd64.deb


• Ubuntu passwd_4.1.1-1ubuntu1.2_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/s/shadow/passwd_4.1.1-1ubu ntu1.2_amd64.deb

Debian Linux 4.0 ia-64

• Debian login_4.0.18.1-7+etch1_ia64.deb
  http://security.debian.org/pool/updates/main/s/shadow/login_4.0.18.1-7 +etch1_ia64.deb


• Debian passwd_4.0.18.1-7+etch1_ia64.deb
  http://security.debian.org/pool/updates/main/s/shadow/passwd_4.0.18.1- 7+etch1_ia64.deb

Debian Linux 4.0 mips

• Debian login_4.0.18.1-7+etch1_mips.deb
  http://security.debian.org/pool/updates/main/s/shadow/login_4.0.18.1-7 +etch1_mips.deb


• Debian passwd_4.0.18.1-7+etch1_mips.deb
  http://security.debian.org/pool/updates/main/s/shadow/passwd_4.0.18.1- 7+etch1_mips.deb

Mandriva Linux Mandrake 2008.1 x86_64

• Mandriva shadow-utils-4.0.12-9.1mdv2008.1.x86_64.rpm
  http://www.mandriva.com/en/download/

Debian Linux 4.0 arm

• Debian login_4.0.18.1-7+etch1_arm.deb
  http://security.debian.org/pool/updates/main/s/shadow/login_4.0.18.1-7 +etch1_arm.deb


• Debian passwd_4.0.18.1-7+etch1_arm.deb
  http://security.debian.org/pool/updates/main/s/shadow/passwd_4.0.18.1- 7+etch1_arm.deb

Mandriva Linux Mandrake 2008.1

• Mandriva shadow-utils-4.0.12-9.1mdv2008.1.i586.rpm
  http://www.mandriva.com/en/download/

Ubuntu Ubuntu Linux 8.10 i386

• Ubuntu login_4.1.1-1ubuntu1.2_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/s/shadow/login_4.1.1-1ubun tu1.2_i386.deb


• Ubuntu passwd_4.1.1-1ubuntu1.2_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/s/shadow/passwd_4.1.1-1ubu ntu1.2_i386.deb

Debian Linux 4.0 powerpc

• Debian login_4.0.18.1-7+etch1_powerpc.deb
  http://security.debian.org/pool/updates/main/s/shadow/login_4.0.18.1-7 +etch1_powerpc.deb


• Debian passwd_4.0.18.1-7+etch1_powerpc.deb
  http://security.debian.org/pool/updates/main/s/shadow/passwd_4.0.18.1- 7+etch1_powerpc.deb

Ubuntu Ubuntu Linux 6.06 LTS powerpc

• Ubuntu login_4.0.13-7ubuntu3.4_powerpc.deb
  http://security.ubuntu.com/ubuntu/pool/main/s/shadow/login_4.0.13-7ubu ntu3.4_powerpc.deb


• Ubuntu passwd_4.0.13-7ubuntu3.4_powerpc.deb
  http://security.ubuntu.com/ubuntu/pool/main/s/shadow/passwd_4.0.13-7ub untu3.4_powerpc.deb

Ubuntu Ubuntu Linux 8.04 LTS lpia

• Ubuntu login_4.0.18.2-1ubuntu2.2_lpia.deb
  http://ports.ubuntu.com/pool/main/s/shadow/login_4.0.18.2-1ubuntu2.2_l pia.deb


• Ubuntu passwd_4.0.18.2-1ubuntu2.2_lpia.deb
  http://ports.ubuntu.com/pool/main/s/shadow/passwd_4.0.18.2-1ubuntu2.2_ lpia.deb

Ubuntu Ubuntu Linux 7.10 lpia

• Ubuntu login_4.0.18.1-9ubuntu0.2_lpia.deb
  http://ports.ubuntu.com/pool/main/s/shadow/login_4.0.18.1-9ubuntu0.2_l pia.deb


• Ubuntu passwd_4.0.18.1-9ubuntu0.2_lpia.deb
  http://ports.ubuntu.com/pool/main/s/shadow/passwd_4.0.18.1-9ubuntu0.2_ lpia.deb

Ubuntu Ubuntu Linux 6.06 LTS i386

• Ubuntu login_4.0.13-7ubuntu3.4_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/s/shadow/login_4.0.13-7ubu ntu3.4_i386.deb


• Ubuntu passwd_4.0.13-7ubuntu3.4_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/s/shadow/passwd_4.0.13-7ub untu3.4_i386.deb

Ubuntu Ubuntu Linux 7.10 i386

• Ubuntu login_4.0.18.1-9ubuntu0.2_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/s/shadow/login_4.0.18.1-9u buntu0.2_i386.deb


• Ubuntu passwd_4.0.18.1-9ubuntu0.2_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/s/shadow/passwd_4.0.18.1-9 ubuntu0.2_i386.deb

Ubuntu Ubuntu Linux 8.10 lpia

• Ubuntu login_4.1.1-1ubuntu1.2_lpia.deb
  http://ports.ubuntu.com/pool/main/s/shadow/login_4.1.1-1ubuntu1.2_lpia .deb


• Ubuntu passwd_4.1.1-1ubuntu1.2_lpia.deb
  http://ports.ubuntu.com/pool/main/s/shadow/passwd_4.1.1-1ubuntu1.2_lpi a.deb

Ubuntu Ubuntu Linux 6.06 LTS amd64

• Ubuntu login_4.0.13-7ubuntu3.4_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/s/shadow/login_4.0.13-7ubu ntu3.4_amd64.deb


• Ubuntu passwd_4.0.13-7ubuntu3.4_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/s/shadow/passwd_4.0.13-7ub untu3.4_amd64.deb

Debian Linux 4.0 sparc

• Debian login_4.0.18.1-7+etch1_sparc.deb
  http://security.debian.org/pool/updates/main/s/shadow/login_4.0.18.1-7 +etch1_sparc.deb


• Debian passwd_4.0.18.1-7+etch1_sparc.deb
  http://security.debian.org/pool/updates/main/s/shadow/passwd_4.0.18.1- 7+etch1_sparc.deb

Debian Linux 4.0 s/390

• Debian login_4.0.18.1-7+etch1_s390.deb
  http://security.debian.org/pool/updates/main/s/shadow/login_4.0.18.1-7 +etch1_s390.deb


• Debian passwd_4.0.18.1-7+etch1_s390.deb
  http://security.debian.org/pool/updates/main/s/shadow/passwd_4.0.18.1- 7+etch1_s390.deb

Mandriva Linux Mandrake 2009.0

• Mandriva shadow-utils-4.0.12-17.1mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/

Debian Linux 4.0 alpha

• Debian login_4.0.18.1-7+etch1_alpha.deb
  http://security.debian.org/pool/updates/main/s/shadow/login_4.0.18.1-7 +etch1_alpha.deb


• Debian passwd_4.0.18.1-7+etch1_alpha.deb
  http://security.debian.org/pool/updates/main/s/shadow/passwd_4.0.18.1- 7+etch1_alpha.deb

Ubuntu Ubuntu Linux 7.10 amd64

• Ubuntu login_4.0.18.1-9ubuntu0.2_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/s/shadow/login_4.0.18.1-9u buntu0.2_amd64.deb


• Ubuntu passwd_4.0.18.1-9ubuntu0.2_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/s/shadow/passwd_4.0.18.1-9 ubuntu0.2_amd64.deb

MandrakeSoft Corporate Server 4.0

• Mandriva shadow-utils-4.0.12-2.1.20060mlcs4.i586.rpm
  http://www.mandriva.com/en/download/

Ubuntu Ubuntu Linux 8.04 LTS i386

• Ubuntu login_4.0.18.2-1ubuntu2.2_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/s/shadow/login_4.0.18.2-1u buntu2.2_i386.deb


• Ubuntu passwd_4.0.18.2-1ubuntu2.2_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/s/shadow/passwd_4.0.18.2-1 ubuntu2.2_i386.deb

MandrakeSoft Multi Network Firewall 2.0

• Mandriva shadow-utils-4.0.3-8.3.C30mdk.i586.rpm
  http://www.mandriva.com/en/download/

MandrakeSoft Corporate Server 3.0

• Mandriva shadow-utils-4.0.3-8.3.C30mdk.i586.rpm
  http://www.mandriva.com/en/download/

MandrakeSoft Corporate Server 3.0 x86_64

• Mandriva shadow-utils-4.0.3-8.3.C30mdk.x86_64.rpm
  http://www.mandriva.com/en/download/

MandrakeSoft Corporate Server 4.0 x86_64

• Mandriva shadow-utils-4.0.12-2.1.20060mlcs4.x86_64.rpm
  http://www.mandriva.com/en/download/

Multiple Linux Distributions 'login' Local Privilege Escalation Vulnerability

References:

• Debian Bug report #505271 (Debian)
  
• /bin/login gives root to group utmp (Paul Szabo )