Debian DSA-2164-1 : shadow - insufficient input sanitization

Kees Cook discovered that the chfn and chsh utilities do not properly sanitize user input that includes newlines. An attacker could use this to corrupt passwd entries and may create users or groups in NIS environments. Packages in the oldstable distribution lenny are not affected by this problem...

DEBIAN-CVE-2011-0721

Multiple CRLF injection vulnerabilities in 1 chfn and 2 chsh in shadow 1:4.1.4 allow local users to add new users or groups to /etc/passwd via the GECOS field...

CVE-2011-0721

CVE-2011-0721 affects the shadow package: CRLF injection in chfn and chsh allows local users to alter /etc/passwd via the GECOS field. Root cause is improper input sanitization of newline characters. Debian and Slackware advisories indicate an updated shadow package as the fix; exploitation detai...

CVE-2011-0721

Multiple CRLF injection vulnerabilities in 1 chfn and 2 chsh in shadow 1:4.1.4 allow local users to add new users or groups to /etc/passwd via the GECOS field...

CVE-2011-0721

Multiple CRLF injection vulnerabilities in 1 chfn and 2 chsh in shadow 1:4.1.4 allow local users to add new users or groups to /etc/passwd via the GECOS field...

CVE-2011-0721: Improper Input Validation

Multiple CRLF injection vulnerabilities in 1 chfn and 2 chsh in shadow 1:4.1.4 allow local users to add new users or groups to /etc/passwd via the GECOS field...

[SECURITY] [DSA 2164-1] shadow security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2164-1 [email protected] http://www.debian.org/security/ Nico Golde February 16, 2011 http://www.debian.org/security/faq -...

DSA-2164-1 shadow - missing input sanitization

Bulletin has no description...

CVE-2011-0721

Multiple CRLF injection vulnerabilities in 1 chfn and 2 chsh in shadow 1:4.1.4 allow local users to add new users or groups to /etc/passwd via the GECOS field...

Apple Directory Services Memory Corruption - CVE-2010-1840

Dear List, I'm writing on behalf of the Check Point Vulnerability Discovery Team to publish the following vulnerability. Check Point Software Technologies - Vulnerability Discovery Team VDT http://www.checkpoint.com/defense/ Apple Directory Services Memory Corruption CVE-2010-1840 INTRODUCTION...

Apple Directory Services - Memory Corruption

Apple Directory Services - Memory Corruption Apple Directory Services Memory Corruption CVE-2010-1840 INTRODUCTION chfn, chpass and chsh dos not properly parse authname switch "-u", which causes the applications to crash when parsing a long string. Those binaries are setuid root by default. This...

Apple Directory Services - Memory Corruption

Apple Directory Services Memory Corruption CVE-2010-1840 INTRODUCTION chfn, chpass and chsh dos not properly parse authname switch "-u", which causes the applications to crash when parsing a long string. Those binaries are setuid root by default. This problem was confirmed in the following versio...

Gentoo Security Advisory GLSA 200411-09 (shadow)

The remote host is missing updates announced in advisory GLSA 200411-09. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...

Gentoo Security Advisory GLSA 200411-09 (shadow)

The remote host is missing updates announced in advisory GLSA 200411-09. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2006-4246

Usermin before 1.220 20060629 allows remote attackers to read arbitrary files, possibly related to chfn/save.cgi not properly handling an empty shell parameter, which results in changing root's shell instead of the shell of a specified user...

CVE-2006-4246

Usermin before 1.220 20060629 allows remote attackers to read arbitrary files, possibly related to chfn/save.cgi not properly handling an empty shell parameter, which results in changing root's shell instead of the shell of a specified user...

CVE-2006-4246: Undefined Security Weakness

Usermin before 1.220 20060629 allows remote attackers to read arbitrary files, possibly related to chfn/save.cgi not properly handling an empty shell parameter, which results in changing root's shell instead of the shell of a specified user...

USN-308-1: shadow vulnerability

Ilja van Sprundel discovered that passwd, when called with the -f, -g, or -s option, did not check the result of the setuid call. On systems that configure PAM limits for the maximum number of user processes, a local attacker could exploit this to execute chfn, gpasswd, or chsh with root...

susechfn.sh.txt

!/bin/sh Exploit for SuSE Linux 9.1,2,3/10.0, Desktop 1.0, UnitedLinux 1.0 and SuSE Linux Enterprise Server 8,9 'chfn' local root bug. by Hunger Advistory: http://lists.suse.com/archive/suse-security-announce/2005-Nov/0002.html hunger@suse: id uid=1000hunger gid=1000hunger groups=1000hunger...

SuSE Linux <= 9.3 10 (chfn) Local Root Privilege Escalation Exploit

No description provided by source. !/bin/sh Exploit for SuSE Linux 9.1,2,3/10.0, Desktop 1.0, UnitedLinux 1.0 and SuSE Linux Enterprise Server 8,9 'chfn' local root bug. by Hunger [email protected] Advistory: http://lists.suse.com/archive/suse-security-announce/2005-Nov/0002.html hunger@suse: id...