An issue was discovered in shadow 4.5. newgidmap (in shadow-utils) is setuid and allows an unprivileged user to be placed in a user namespace where setgroups(2) is permitted. This allows an attacker to remove themselves from a supplementary group, which may allow access to certain filesystem paths if the administrator has used "group blacklisting" (e.g., chmod g-rwx) to restrict access to paths. This flaw effectively reverts a security feature in the kernel (in particular, the /proc/self/setgroups knob) to prevent this sort of privilege escalation.

The remote Ubuntu 16.04 ESM / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5254-1 advisory.

    It was discovered that shadow incorrectly handled certain inputs. An attacker could possibly use this     issue to cause a crash or expose sensitive information. This issue only affected Ubuntu 14.04 ESM and     Ubuntu 16.04 ESM. (CVE-2017-12424)

    It was discovered that shadow incorrectly handled certain inputs. An attacker could possibly use this     issue to expose sensitive information. (CVE-2018-7169)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the shadow package has been released.

Minor security update to version 4.6

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201805-09 (Shadow: security bypass)

    A local attacker could possibly bypass security restrictions if an       administrator used &ldquo;group blacklisting&rdquo; to restrict access to file       system paths.
  Impact :

    A local attacker could possibly bypass security restrictions.
  Workaround :

    There is no known workaround at this time.

This update for shadow fixes the following issues :

  - CVE-2018-7169: Fixed an privilege escalation in     newgidmap, which allowed an unprivileged user to be     placed in a user namespace where setgroups(2) is     allowed. (bsc#1081294)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for shadow fixes the following issues :

  - CVE-2018-7169: Fixed an privilege escalation in     newgidmap, which allowed an unprivileged user to be     placed in a user namespace where setgroups(2) is     allowed. (bsc#1081294)

This update was imported from the SUSE:SLE-12-SP2:Update update project.

ID	Name	Product	Family	Severity
157160	Ubuntu 16.04 ESM / 18.04 LTS : shadow vulnerabilities (USN-5254-1)	Nessus	Ubuntu Local Security Checks	critical
121979	Photon OS 2.0: Shadow PHSA-2018-2.0-0080	Nessus	PhotonOS Local Security Checks	medium
121873	Photon OS 1.0: Shadow PHSA-2018-1.0-0171	Nessus	PhotonOS Local Security Checks	medium
120343	Fedora 28 : 2:shadow-utils (2018-35254ad97d)	Nessus	Fedora Local Security Checks	medium
109976	GLSA-201805-09 : Shadow: security bypass	Nessus	Gentoo Local Security Checks	medium
108509	SUSE SLED12 / SLES12 Security Update : shadow (SUSE-SU-2018:0662-1)	Nessus	SuSE Local Security Checks	medium
108271	openSUSE Security Update : shadow (openSUSE-2018-249)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2018-7169

medium

Tenable Plugins

critical

medium

medium

medium

medium

medium

medium