In Shadow 4.13 it is possible to inject control characters into fields provided to the SUID program chfn (change finger). Although it is not possible to exploit this directly (e.g. adding a new user fails because \n is in the block list) it is possible to misrepresent the /etc/passwd file when viewed. Use of \r manipulations and Unicode characters to work around blocking of the : character make it possible to give the impression that a new user has been added. In other words an adversary may be able to convince a system administrator to take the system offline (an indirect social-engineered denial of service) by demonstrating that "cat /etc/passwd" shows a rogue user account.

🗓️ 24 Apr 2023 07:00:00Reported by MicrosoftType

Shadow 4.13 allows control character injection into chfn fields to misrepresent password file.

Reporter	Title	Published	Views	Family All 82
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation 24.0.0-IF005 and 24.0.1-IF002.	2 May 202507:23	–	ibm
AlpineLinux	CVE-2023-29383	14 Apr 202300:00	–	alpinelinux
AstraLinux	Astra Linux - уязвимость в shadow	20 May 202605:53	–	astralinux
BDU FSTEC	The vulnerability of the Shadow account management tool lies in the insufficient neutralization of certain elements in the query, allowing a malicious actor to compromise data integrity.	13 Sep 202400:00	–	bdu_fstec
CBLMariner	CVE-2023-29383 affecting package shadow-utils for versions less than 4.9-13	31 Jan 202516:07	–	cbl_mariner
Circl	CVE-2023-29383	17 Nov 202302:53	–	circl
CNNVD	shadow 注入漏洞	14 Apr 202300:00	–	cnnvd
CVE	CVE-2023-29383	14 Apr 202300:00	–	cve
Cvelist	CVE-2023-29383	14 Apr 202300:00	–	cvelist
Debian	[SECURITY] [DLA 4130-1] shadow security update	18 Apr 202519:44	–	debian