Lucene search

UbuntuUSN-5745-1

HistoryNov 28, 2022 - 12:00 a.m.

shadow vulnerability

2022-11-2800:00:00

ubuntu.com

ubuntu

shadow

user directory trees

race condition

symlink attack

unauthorized access

security

3.3 Low

CVSS2

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:M/Au:N/C:N/I:P/A:P

4.7 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N

5.2 Medium

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

17.4%

JSON

Releases

Ubuntu 22.10
Ubuntu 22.04 LTS
Ubuntu 20.04 LTS
Ubuntu 18.04 ESM
Ubuntu 16.04 ESM
Ubuntu 14.04 ESM

Packages

shadow - system login tools

Details

Florian Weimer discovered that shadow was not properly copying and removing
user directory trees, which could lead to a race condition. A local attacker
could possibly use this issue to setup a symlink attack and alter or remove
directories without authorization.

OSVersionArchitecturePackageVersionFilename
Ubuntu22.10noarchpasswd< 1:4.11.1+dfsg1-2ubuntu1.1UNKNOWN
Ubuntu22.10noarchlibsubid-dev< 1:4.11.1+dfsg1-2ubuntu1.1UNKNOWN
Ubuntu22.10noarchlibsubid4< 1:4.11.1+dfsg1-2ubuntu1.1UNKNOWN
Ubuntu22.10noarchlibsubid4-dbgsym< 1:4.11.1+dfsg1-2ubuntu1.1UNKNOWN
Ubuntu22.10noarchlogin< 1:4.11.1+dfsg1-2ubuntu1.1UNKNOWN
Ubuntu22.10noarchlogin-dbgsym< 1:4.11.1+dfsg1-2ubuntu1.1UNKNOWN
Ubuntu22.10noarchpasswd-dbgsym< 1:4.11.1+dfsg1-2ubuntu1.1UNKNOWN
Ubuntu22.10noarchuidmap< 1:4.11.1+dfsg1-2ubuntu1.1UNKNOWN
Ubuntu22.10noarchuidmap-dbgsym< 1:4.11.1+dfsg1-2ubuntu1.1UNKNOWN
Ubuntu22.04noarchpasswd< 1:4.8.1-2ubuntu2.1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
Ubuntu	22.10	noarch	passwd	< 1:4.11.1+dfsg1-2ubuntu1.1	UNKNOWN
Ubuntu	22.10	noarch	libsubid-dev	< 1:4.11.1+dfsg1-2ubuntu1.1	UNKNOWN
Ubuntu	22.10	noarch	libsubid4	< 1:4.11.1+dfsg1-2ubuntu1.1	UNKNOWN
Ubuntu	22.10	noarch	libsubid4-dbgsym	< 1:4.11.1+dfsg1-2ubuntu1.1	UNKNOWN
Ubuntu	22.10	noarch	login	< 1:4.11.1+dfsg1-2ubuntu1.1	UNKNOWN
Ubuntu	22.10	noarch	login-dbgsym	< 1:4.11.1+dfsg1-2ubuntu1.1	UNKNOWN
Ubuntu	22.10	noarch	passwd-dbgsym	< 1:4.11.1+dfsg1-2ubuntu1.1	UNKNOWN
Ubuntu	22.10	noarch	uidmap	< 1:4.11.1+dfsg1-2ubuntu1.1	UNKNOWN
Ubuntu	22.10	noarch	uidmap-dbgsym	< 1:4.11.1+dfsg1-2ubuntu1.1	UNKNOWN
Ubuntu	22.04	noarch	passwd	< 1:4.8.1-2ubuntu2.1	UNKNOWN