Buffer overflow in shadow

Published: 2017-08-04 | Updated: 2020-07-28

Risk	High
Patch available	YES
Number of vulnerabilities	1
CVE-ID	CVE-2017-12424
CWE-ID	CWE-119
Exploitation vector	Network
Public exploit	N/A
Vulnerable software Subscribe	shadow Universal components / Libraries / Libraries used by multiple products
Vendor	Mark Florian

Security Bulletin

This security bulletin contains one high risk vulnerability.

1) Buffer overflow

EUVDB-ID: #VU32061

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-12424

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

In shadow before 4.5, the newusers tool could be made to manipulate internal data structures in ways unintended by the authors. Malformed input may lead to crashes (with a buffer overflow or other memory corruption) or other unspecified behaviors. This crosses a privilege boundary in, for example, certain web-hosting environments in which a Control Panel allows an unprivileged user account to create subaccounts.

Mitigation

Install update from vendor's website.

Vulnerable software versions

shadow: 4.0.0 - 4.4.0

External links

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=756630
http://bugs.launchpad.net/ubuntu/+source/shadow/+bug/1266675
http://github.com/shadow-maint/shadow/commit/954e3d2e7113e9ac06632aee3c69b8d818cc8952
http://security.gentoo.org/glsa/201710-16

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.