Executive Summary

Summary
Title Shadow Utils useradd utility sets incorrect file permissions
Informations
Name VU#312692 First vendor Publication 2007-12-14
Vendor VU-CERT Last vendor Modification 2007-12-14
Severity (Vendor) N/A Revision M

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:L/AC:H/Au:N/C:P/I:P/A:P)
Cvss Base Score 3.7 Attack Range Local
Cvss Impact Score 6.4 Attack Complexity High
Cvss Expoit Score 1.9 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Vulnerability Note VU#312692

Shadow Utils useradd utility sets incorrect file permissions

Overview

The Shadow Utilities contain a vulnerability that may result in new user mailboxes having arbitrary permissions.

I. Description

The Shadow Utilities provide tools to manage user accounts.

When a new mailbox is created using the useradd utility, the open() function does not receive the expected arguments while O_CREAT is present. The result of this error is that random permissions are applied to the new mailbox.

II. Impact

A local, unprivileged attacker may be able to gain access to newly created mailbox files.

III. Solution

Affected vendors have released updates to address this issue. Users are encouraged to see the Systems Affected portion of this document for a partial list of affected vendors.

Systems Affected

VendorStatusDate Updated
Apple Computer, Inc.Not Vulnerable23-May-2006
Cisco Systems, Inc.Unknown12-May-2006
Conectiva Inc.Unknown17-May-2006
Cray Inc.Unknown17-May-2006
Debian GNU/LinuxUnknown17-May-2006
EMC, Inc. (formerly Data General Corporation)Unknown17-May-2006
Engarde Secure LinuxUnknown17-May-2006
F5 Networks, Inc.Not Vulnerable22-May-2006
Fedora ProjectUnknown17-May-2006
FreeBSD, Inc.Unknown17-May-2006
FujitsuUnknown17-May-2006
Gentoo LinuxVulnerable14-Dec-2007
Hewlett-Packard CompanyUnknown17-May-2006
HitachiUnknown17-May-2006
IBM CorporationUnknown17-May-2006
IBM Corporation (zseries)Unknown17-May-2006
IBM eServerUnknown17-May-2006
Immunix Communications, Inc.Unknown17-May-2006
Ingrian Networks, Inc.Unknown17-May-2006
Juniper Networks, Inc.Unknown17-May-2006
Mandriva, Inc.Unknown17-May-2006
Microsoft CorporationUnknown17-May-2006
MontaVista Software, Inc.Unknown17-May-2006
NEC CorporationUnknown17-May-2006
NetBSDUnknown17-May-2006
NokiaUnknown17-May-2006
Novell, Inc.Unknown17-May-2006
OpenBSDUnknown17-May-2006
Openwall GNU/*/LinuxNot Vulnerable17-May-2006
QNX, Software Systems, Inc.Unknown17-May-2006
Red Hat, Inc.Unknown12-May-2006
Silicon Graphics, Inc.Unknown17-May-2006
Slackware Linux Inc.Unknown17-May-2006
Sony CorporationUnknown17-May-2006
Sun Microsystems, Inc.Unknown17-May-2006
SUSE LinuxUnknown17-May-2006
Trustix Secure LinuxUnknown17-May-2006
TurbolinuxUnknown17-May-2006
UbuntuUnknown17-May-2006
UnisysUnknown17-May-2006
Wind River Systems, Inc.Unknown17-May-2006

References


http://linux.die.net/man/8/useradd
http://www.redhat.com/docs/manuals/enterprise/RHEL-5-manual/Deployment_Guide-en-US/s1-users-tools.html
http://www.gentoo.org/security/en/glsa/glsa-200606-02.xml
http://cvsweb.openwall.com/cgi/cvsweb.cgi/Owl/packages/shadow-utils/shadow-4.0.4.1-owl-create-mailbox.diff?rev=HEAD
http://www.securityfocus.com/archive/1/archive/1/468336/100/0/threaded
https://www.securecoding.cert.org/confluence/x/VQBc

Credit

This document was written by Jeff Gennari.

Other Information

Date Public05/31/2006
Date First Published12/14/2007 09:33:38 AM
Date Last Updated12/14/2007
CERT Advisory 
CVE NameCVE-2006-1174
Metric0.23
Document Revision27

Original Source

Url : http://www.kb.cert.org/vuls/id/312692

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-264 Permissions, Privileges, and Access Controls

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:10807
 
Oval ID: oval:org.mitre.oval:def:10807
Title: useradd in shadow-utils before 4.0.3, and possibly other versions before 4.0.8, does not provide a required argument to the open function when creating a new user mailbox, which causes the mailbox to be created with unpredictable permissions and possibly allows attackers to read or modify the mailbox.
Description: useradd in shadow-utils before 4.0.3, and possibly other versions before 4.0.8, does not provide a required argument to the open function when creating a new user mailbox, which causes the mailbox to be created with unpredictable permissions and possibly allows attackers to read or modify the mailbox.
Family: unix Class: vulnerability
Reference(s): CVE-2006-1174
 Version: 5
Platform(s): Red Hat Enterprise Linux 3
CentOS Linux 3
Red Hat Enterprise Linux 4
CentOS Linux 4
Oracle Linux 4
 Product(s):
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 10

OpenVAS Exploits

Date Description
2008-09-24 Name : Gentoo Security Advisory GLSA 200606-02 (shadow)
File : nvt/glsa_200606_02.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
25848 Shadow useradd.c Mailbox Permission Weakness

Nessus® Vulnerability Scanner

Date Description
2013-07-12 Name : The remote Oracle Linux host is missing a security update.
File : oraclelinux_ELSA-2007-0276.nasl - Type : ACT_GATHER_INFO
2013-07-12 Name : The remote Oracle Linux host is missing a security update.
File : oraclelinux_ELSA-2007-0431.nasl - Type : ACT_GATHER_INFO
2013-06-29 Name : The remote CentOS host is missing a security update.
File : centos_RHSA-2007-0276.nasl - Type : ACT_GATHER_INFO
2012-08-01 Name : The remote Scientific Linux host is missing a security update.
File : sl_20070501_shadow_utils_on_SL4_x.nasl - Type : ACT_GATHER_INFO
2012-08-01 Name : The remote Scientific Linux host is missing a security update.
File : sl_20070611_shadow_utils_on_SL3.nasl - Type : ACT_GATHER_INFO
2009-07-27 Name : The remote VMware ESX host is missing one or more security-related patches.
File : vmware_VMSA-2007-0006.nasl - Type : ACT_GATHER_INFO
2007-06-14 Name : The remote CentOS host is missing a security update.
File : centos_RHSA-2007-0431.nasl - Type : ACT_GATHER_INFO
2007-06-12 Name : The remote Red Hat host is missing a security update.
File : redhat-RHSA-2007-0431.nasl - Type : ACT_GATHER_INFO
2007-05-02 Name : The remote Red Hat host is missing a security update.
File : redhat-RHSA-2007-0276.nasl - Type : ACT_GATHER_INFO
2006-06-08 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-200606-02.nasl - Type : ACT_GATHER_INFO