Ubuntu 17.04 USN-3276-1 Moderate: Admin Access Issue in Shadow

ubuntu

May 5, 2017

su could be made to crash or stop programs as an administrator.

Summary

su could be made to crash or stop programs as an administrator.

Software Description:

- shadow: system login tools

Details:

Sebastian Krahmer discovered integer overflows in shadow utilities.

A local attacker could possibly cause them to crash or potentially

gain privileges via crafted input. (CVE-2016-6252)

Tobias Stöckmann discovered a race condition in su. A local

attacker could cause su to send SIGKILL to other processes with

root privileges. (CVE-2017-2616)

Topics Covered

security advisory moderate severity local threat ubuntu shadow admin access program interruption

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 17.04:
  login                           1:4.2-3.2ubuntu1.17.04.1
  passwd                          1:4.2-3.2ubuntu1.17.04.1
  uidmap                          1:4.2-3.2ubuntu1.17.04.1

Ubuntu 16.10:
  login                           1:4.2-3.2ubuntu1.16.10.1
  passwd                          1:4.2-3.2ubuntu1.16.10.1
  uidmap                          1:4.2-3.2ubuntu1.16.10.1

Ubuntu 16.04 LTS:
  login                           1:4.2-3.1ubuntu5.2
  passwd                          1:4.2-3.1ubuntu5.2
  uidmap                          1:4.2-3.1ubuntu5.2

Ubuntu 14.04 LTS:
  login                           1:4.1.5.1-1ubuntu9.4
  passwd                          1:4.1.5.1-1ubuntu9.4
  uidmap                          1:4.1.5.1-1ubuntu9.4

In general, a standard system update will make all the necessary changes.