Detections
Analytics
CentOS 4 : shadow-utils (CESA-2007:0276)
low Nessus Plugin ID 67048
Language:
Synopsis
The remote CentOS host is missing a security update.Description
Updated shadow-utils packages that fix a security issue and various bugs are now available.This update has been rated as having low security impact by the Red Hat Security Response Team.
The shadow-utils package includes the necessary programs for converting UNIX password files to the shadow password format, as well as programs for managing user and group accounts.
A flaw was found in the useradd tool in shadow-utils. A new user's mailbox, when created, could have random permissions for a short period. This could allow a local attacker to read or modify the mailbox. (CVE-2006-1174)
This update also fixes the following bugs :
* shadow-utils debuginfo package was empty.
* faillog was unusable on 64-bit systems. It checked every UID from 0 to the max UID, which was an excessively large number on 64-bit systems.
* typo bug in login.defs file
All users of shadow-utils are advised to upgrade to these updated packages, which contain backported patches to resolve these issues.
Solution
Update the affected shadow-utils package.See Also
Plugin Details
Severity: Low
ID: 67048
File Name: centos_RHSA-2007-0276.nasl
Version: 1.6
Type: local
Agent: unix
Family: CentOS Local Security Checks
Published: 6/29/2013
Updated: 1/4/2021
Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Agentless Assessment, Continuous Assessment, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 6.0
CVSS v2
Risk Factor: Low
Base Score: 3.7
Vector: CVSS2#AV:L/AC:H/Au:N/C:P/I:P/A:P
Vulnerability Information
CPE: cpe:/o:centos:centos:4, p-cpe:/a:centos:centos:shadow-utils
Required KB Items: Host/local_checks_enabled, Host/CentOS/release, Host/CentOS/rpm-list
Patch Publication Date: 5/2/2007
Vulnerability Publication Date: 5/28/2006
Reference Information
CVE: CVE-2006-1174
RHSA: 2007:0276