Detections
Analytics

Debian DSA-585-1 : shadow - programming error

medium Nessus Plugin ID 15683

Synopsis

The remote Debian host is missing a security-related update.

Description

A vulnerability has been discovered in the shadow suite which provides programs like chfn and chsh. It is possible for a user, who is logged in but has an expired password to alter his account information with chfn or chsh without having to change the password. The problem was originally thought to be more severe.

Solution

Upgrade the passwd package (from the shadow suite).

For the stable distribution (woody) this problem has been fixed in version 20000902-12woody1.

See Also

http://www.debian.org/security/2004/dsa-585

Plugin Details

Severity: Medium

ID: 15683

File Name: debian_DSA-585.nasl

Version: 1.19

Type: local

Agent: unix

Published: 11/10/2004

Updated: 1/4/2021

Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.2

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Vector: CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Information

CPE: cpe:/o:debian:debian_linux:3.0, p-cpe:/a:debian:debian_linux:shadow

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Patch Publication Date: 11/5/2004

Vulnerability Publication Date: 10/27/2004

Reference Information

CVE: CVE-2004-1001

DSA: 585