In shadow before 4.5, the newusers tool could be made to manipulate internal data structures in ways unintended by the authors. Malformed input may lead to crashes (with a buffer overflow or other memory corruption) or other unspecified behaviors. This crosses a privilege boundary in, for example, certain web-hosting environments in which a Control Panel allows an unprivileged user account to create subaccounts.

The remote Ubuntu 16.04 ESM / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5254-1 advisory.

    It was discovered that shadow incorrectly handled certain inputs. An attacker could possibly use this     issue to cause a crash or expose sensitive information. This issue only affected Ubuntu 14.04 ESM and     Ubuntu 16.04 ESM. (CVE-2017-12424)

    It was discovered that shadow incorrectly handled certain inputs. An attacker could possibly use this     issue to expose sensitive information. (CVE-2018-7169)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities were discovered in the shadow suite of login tools. An attacker may escalate privileges in specific configurations.

CVE-2017-20002

Shadow incorrectly lists pts/0 and pts/1 as physical terminals in /etc/securetty. This allows local users to login as password-less users even if they are connected by non-physical means such as SSH (hence bypassing PAM's nullok_secure configuration). This notably affects environments such as virtual machines automatically generated with a default blank root password, allowing all local users to escalate privileges. It should be noted however that /etc/securetty will be dropped in Debian 11/bullseye.

CVE-2017-12424

The newusers tool could be made to manipulate internal data structures in ways unintended by the authors. Malformed input may lead to crashes (with a buffer overflow or other memory corruption) or other unspecified behaviors. This crosses a privilege boundary in, for example, certain web-hosting environments in which a Control Panel allows an unprivileged user account to create subaccounts.

For Debian 9 stretch, these problems have been fixed in version 1:4.4-4.1+deb9u1.

We recommend that you upgrade your shadow packages.

For the detailed security status of shadow please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/shadow

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the shadow-utils package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In shadow before 4.5, the newusers tool could be made     to manipulate internal data structures in ways     unintended by the authors. Malformed input may lead to     crashes (with a buffer overflow or other memory     corruption) or other unspecified behaviors. This     crosses a privilege boundary in, for example, certain     web-hosting environments in which a Control Panel     allows an unprivileged user account to create     subaccounts.(CVE-2017-12424)

  - Integer overflow in shadow 4.2.1 allows local users to     gain privileges via crafted input to     newuidmap.(CVE-2016-6252)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the shadow package has been released.

According to the version of the shadow-utils package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - A buffer overflow flaw leading to heap memory     corruption was found in the shadow-utils's newusers     utility. A local, authenticated attacker could     potentially use this flaw to crash the newusers process     by supplying crafted data to it.(CVE-2017-12424)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for shadow fixes several issues.

This security issue was fixed :

  - CVE-2017-12424: The newusers tool could have been forced     to manipulate internal data structures in ways     unintended by the authors. Malformed input may have lead     to crashes (with a buffer overflow or other memory     corruption) or other unspecified behaviors     (bsc#1052261).

These non-security issues were fixed :

  - bsc#1023895: Fixed man page to not contain invalid     options and also prevent warnings when using these     options in certain settings

  - bsc#980486: Reset user in /var/log/tallylog because of     the usage of pam_tally2

This update was imported from the SUSE:SLE-12-SP2:Update update project.

This update for shadow fixes several issues. This security issue was fixed :

  - CVE-2017-12424: The newusers tool could have been forced     to manipulate internal data structures in ways     unintended by the authors. Malformed input may have lead     to crashes (with a buffer overflow or other memory     corruption) or other unspecified behaviors     (bsc#1052261).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201710-16 (Shadow: Buffer overflow)

    Malformed input in the newusers tool may produce crashes and other       unspecified behaviors.
  Impact :

    A remote attacker could possibly cause a Denial of Service condition or       bypass privilege boundaries in some web-hosting environments in which a       Control Panel allows an unprivileged user account to create subaccounts.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
157160	Ubuntu 16.04 ESM / 18.04 LTS : shadow vulnerabilities (USN-5254-1)	Nessus	Ubuntu Local Security Checks	critical
147813	Debian DLA-2596-1 : shadow security update	Nessus	Debian Local Security Checks	critical
131581	EulerOS 2.0 SP2 : shadow-utils (EulerOS-SA-2019-2427)	Nessus	Huawei Local Security Checks	critical
121727	Photon OS 1.0: Shadow PHSA-2017-0030	Nessus	PhotonOS Local Security Checks	critical
110745	EulerOS 2.0 SP3 : shadow-utils (EulerOS-SA-2018-1169)	Nessus	Huawei Local Security Checks	critical
104523	openSUSE Security Update : shadow (openSUSE-2017-1265)	Nessus	SuSE Local Security Checks	critical
104472	SUSE SLED12 / SLES12 Security Update : shadow (SUSE-SU-2017:2947-1)	Nessus	SuSE Local Security Checks	critical
103851	GLSA-201710-16 : Shadow: Buffer overflow	Nessus	Gentoo Local Security Checks	critical

Detections

Analytics

CVE-2017-12424

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical