Executive Summary
| Summary | |
|---|---|
| Title | passwd vulnerability |
| Informations | |||
|---|---|---|---|
| Name | USN-17-1 | First vendor Publication | 2004-11-04 |
| Vendor | Ubuntu | Last vendor Modification | 2004-11-04 |
| Severity (Vendor) | N/A | Revision | N/A |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:L/AC:L/Au:N/C:P/I:P/A:P) | |||
|---|---|---|---|
| Cvss Base Score | 4.6 | Attack Range | Local |
| Cvss Impact Score | 6.4 | Attack Complexity | Low |
| Cvss Expoit Score | 3.9 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| A security issue affects the following Ubuntu releases: Ubuntu 4.10 (Warty Warthog) The following packages are affected: login The problem can be corrected by upgrading the affected package to version 1:4.0.3-28.5ubuntu6.1. In general, a standard system upgrade is sufficient to effect the necessary changes. Details follow: Martin Schulze and Steve Grubb discovered a flaw in the authentication input validation of the "chfn" and "chsh" programs. This allowed logged in users with an expired password to change their real name and their login shell without having to change their password. This flaw cannot lead to privilege escalation and does not allow to modify account properties of other users, so the impact is relatively low. |
Original Source
| Url : http://www.ubuntu.com/usn/USN-17-1 |
Alert History
| Date | Informations |
|---|---|
| 2016-04-26 13:54:10 |
|
| 2014-02-17 12:01:23 |
|
| 2013-05-11 12:25:09 |
|
