Stay Secure with the Latest Linux Advisories

security advisoryDebianlocal threat

Debian: DSA-2164-1 Severe: passwd Input Flaw Threatens Security

Kees Cook discovered that the chfn and chsh utilities do not properly sanitize user input that includes newlines. An attacker could use this to to corrupt passwd entries and may create users or groups in NIS environments. . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2164-1 This email address is being protected from spambots. You need JavaScript enabled to view it. http://www.debian.org/security/ Nico Golde February 16, 2011 http://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : shadow Vulnerability : insufficient input sanitization Problem type : local Debian-specific: no CVE ID : CVE-2011-0721 Kees Cook discovered that the chfn and chsh utilities do not properly sanitize user input that includes newlines. An attacker could use this to to corrupt passwd entries and may create users or groups in NIS environments. Packages in the oldstable distribution (lenny) are not affected by this problem. For the stable distribution (squeeze), this problem has been fixed in version 1:4.1.4.2+svn3283-2+squeeze1. For the testing (wheezy) and unstable (sid) distributions, this problem will be fixed soon. We recommend that you upgrade your shadow packages. Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: http://www.debian.org/security/ Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it. . In a recent development, Kees Cook identified vulnerabilities within the chfn and chsh tools in Debian, granting potential attackers the ability to manipulate password records.. input Sanitization, Debian Update, Shadow Security. . LinuxSecurity.com Team

Feb 16, 2011 Debian