Ubuntu 17.04 USN-3276-2 Moderate: Shadow Signal Handling Regression

ubuntu

May 17, 2017

USN-3276-1 introduced a regression in su.

Summary

USN-3276-1 introduced a regression in su.

Software Description:

- shadow: system login tools

Details:

USN-3276-1 intended to fix a vulnerability in su. The solution introduced

a regression in su signal handling. This update modifies the security fix.

We apologize for the inconvenience.

Original advisory details:

Sebastian Krahmer discovered integer overflows in shadow utilities.

A local attacker could possibly cause them to crash or potentially

gain privileges via crafted input. (CVE-2016-6252)

Tobias Stöckmann discovered a race condition in su. A local

attacker could cause su to send SIGKILL to other processes with

root privileges. (CVE-2017-2616)

Topics Covered

security advisory update Ubuntu local attack shadow signal handling regression

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 17.04:
  login                           1:4.2-3.2ubuntu1.17.04.2
  passwd                          1:4.2-3.2ubuntu1.17.04.2
  uidmap                          1:4.2-3.2ubuntu1.17.04.2

Ubuntu 16.10:
  login                           1:4.2-3.2ubuntu1.16.10.2
  passwd                          1:4.2-3.2ubuntu1.16.10.2
  uidmap                          1:4.2-3.2ubuntu1.16.10.2

Ubuntu 16.04 LTS:
  login                           1:4.2-3.1ubuntu5.3
  passwd                          1:4.2-3.1ubuntu5.3
  uidmap                          1:4.2-3.1ubuntu5.3

Ubuntu 14.04 LTS:
  login                           1:4.1.5.1-1ubuntu9.5
  passwd                          1:4.1.5.1-1ubuntu9.5
  uidmap                          1:4.1.5.1-1ubuntu9.5

In general, a standard system update will make all the necessary changes.