Improper Neutralization of Special Elements in Output Used by a Downstream Component in shadow - CVE-2023-29383

Vulnerability identifier: #VU75589

CSH Severity: Low

CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-29383

CWE-ID: CWE-74

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to inject arbitrary code.

The vulnerability exists due to an input validation error when processing fields provided to the SUID program chfn (change finger). A local user can inject and execute arbitrary code or misrepresent existing files.

shadow
Dell EMC PowerProtect Data Protection
Dell Data Protection Central
Guardium Data Security Center (GDSC)
ObjectScale
EMC Cloud Tiering Appliance
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Server for SAP Applications 12
SUSE CaaS Platform
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
openSUSE Leap Micro
SUSE Enterprise Storage
SUSE OpenStack Cloud Crowbar
SUSE OpenStack Cloud
SUSE Linux Enterprise Server 12 SP2 BCL
SUSE Linux Enterprise Server 12 SP4 LTSS
SUSE Linux Enterprise Server 12 SP4 ESPOS
SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS
SUSE Linux Enterprise Server 15 SP1 LTSS
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP3 LTSS
Basesystem Module
openSUSE Leap
openEuler
shadow
shadow-debugsource
shadow-debuginfo
shadow-help
login_defs
RecoverPoint for VMs
Dell EMC VxRail Appliance
Dell EMC NetWorker vProxy

Install updates from vendor's website.

Guardium Data Security Center (GDSC) - update to 3.6.1
ObjectScale - update to 1.4.0
shadow - addressed in versions 4.2.1-27.22.1, 4.2.1-36.3.1, 4.6-150100.3.8.1, 4.8.1-150300.4.6.1, 4.8.1-150400.10.6.1
shadow-debugsource - addressed in versions 4.2.1-27.22.1, 4.2.1-36.3.1, 4.6-150100.3.8.1, 4.8.1-150300.4.6.1, 4.8.1-150400.10.6.1
shadow-debuginfo - addressed in versions 4.2.1-27.22.1, 4.2.1-36.3.1, 4.6-150100.3.8.1, 4.8.1-150300.4.6.1, 4.8.1-150400.10.6.1
shadow-help - update to 4.8.1-7
shadow-debugsource - update to 4.8.1-7
shadow-debuginfo - update to 4.8.1-7
shadow - update to 4.8.1-7
login_defs - addressed in versions 4.8.1-150300.4.6.1, 4.8.1-150400.10.6.1
RecoverPoint for VMs - update to 6.0.SP1.P1
Dell EMC VxRail Appliance - update to 8.0.101
EMC Cloud Tiering Appliance - addressed in versions 13.1.0.2.33, 13.2.0.2.24
Dell EMC NetWorker vProxy - addressed in versions 19.8.0.3, 19.9.0.2

• https://github.com/shadow-maint/shadow/commit/e5905c4b84d4fb90aefcd96ee618411ebfac663d
• https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=31797
• https://github.com/shadow-maint/shadow/pull/687
• https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/cve-2023-29383-abusing-linux-chfn-to-misrepresent-etc-passwd/

• Code injection in Shadow
• SUSE update for shadow
• SUSE update for shadow
• SUSE update for shadow
• SUSE update for shadow
• SUSE update for shadow
• Multiple vulnerabilities in Dell EMC VxRail Appliance
• Multiple vulnerabilities in Dell Data Protection Central
• Multiple vulnerabilities in Dell Cloud Tiering Appliance
• Multiple vulnerabilities in Dell Cloud Tiering Appliance
• Multiple vulnerabilities in Dell NetWorker vProxy
• openEuler update for shadow
• Multiple vulnerabilities in Dell ObjectScale
• Multiple vulnerabilities in Dell RecoverPoint for Virtual Machines
• Multiple vulnerabilities in Guardium Data Security Center