OSVDB ID: 26995 Title: shadow setuid Failure Local Privilege Escalation |
Info |
|
|
Dates |
||||
|
|
Description |
Shadow contains a flaw that may allow a malicious user to gain access to unauthorized privileges. The issue is triggered when passwd, called with the -f, -g, or -s option, did not check the result of the 'setuid' call. This flaw may lead to a loss of Confidentiality and Integrity. |
Classification |
Location:
Local Access Required
Attack Type: Other Impact: Loss of Confidentiality, Loss of Integrity Exploit: Exploit Unknown Disclosure: OSVDB Verified |
Solution |
Upgrade to version 4.0.14 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds. |
Products |
|
References |
Credit |
|