Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
securityvulnsSecurityvulnsSECURITYVULNS:DOC:25751
HistoryFeb 17, 2011 - 12:00 a.m.

[USN-1065-1] shadow vulnerability

2011-02-1700:00:00
vulners.com
11
JSON

===========================================================
Ubuntu Security Notice USN-1065-1 February 15, 2011
shadow vulnerability
CVE-2011-0721

A security issue affects the following Ubuntu releases:

Ubuntu 9.10
Ubuntu 10.04 LTS
Ubuntu 10.10

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 9.10:
passwd 1:4.1.4.1-1ubuntu2.2

Ubuntu 10.04 LTS:
passwd 1:4.1.4.2-1ubuntu2.2

Ubuntu 10.10:
passwd 1:4.1.4.2-1ubuntu3.2

In general, a standard system update will make all the necessary changes.

Details follow:

Kees Cook discovered that some shadow utilities did not correctly validate
user input. A local attacker could exploit this flaw to inject newlines into
the /etc/passwd file. If the system was configured to use NIS, this could
lead to existing NIS groups or users gaining or losing access to the system,
resulting in a denial of service or unauthorized access.

Updated packages for Ubuntu 9.10:

Source archives:

http://security.ubuntu.com/ubuntu/pool/main/s/shadow/shadow_4.1.4.1-1ubuntu2.2.diff.gz
  Size/MD5:    80909 51c66e9b503868bdedd54efe4928cfa3
http://security.ubuntu.com/ubuntu/pool/main/s/shadow/shadow_4.1.4.1-1ubuntu2.2.dsc
  Size/MD5:     2349 aafbd5790c84b6d4c4ca8e26d5c22198
http://security.ubuntu.com/ubuntu/pool/main/s/shadow/shadow_4.1.4.1.orig.tar.gz
  Size/MD5:  2781704 9f7882c359156aef377cbe9ffac9353e

amd64 architecture (Athlon64, Opteron, EM64T Xeon):

http://security.ubuntu.com/ubuntu/pool/main/s/shadow/login_4.1.4.1-1ubuntu2.2_amd64.deb
  Size/MD5:   320530 263ed41dfe971c3996b93b4497050089
http://security.ubuntu.com/ubuntu/pool/main/s/shadow/passwd_4.1.4.1-1ubuntu2.2_amd64.deb
  Size/MD5:   954262 c01298f5056b5a917106e294ca1872b8

i386 architecture (x86 compatible Intel/AMD):

http://security.ubuntu.com/ubuntu/pool/main/s/shadow/login_4.1.4.1-1ubuntu2.2_i386.deb
  Size/MD5:   311918 9e71b023fd5e25ce6c1e49d51debb33b
http://security.ubuntu.com/ubuntu/pool/main/s/shadow/passwd_4.1.4.1-1ubuntu2.2_i386.deb
  Size/MD5:   875522 f0f66df1a33eeab27ced964bdd0e83b1

armel architecture (ARM Architecture):

http://ports.ubuntu.com/pool/main/s/shadow/login_4.1.4.1-1ubuntu2.2_armel.deb
  Size/MD5:   313518 c2c22045cd6e83fbd524251b348799d8
http://ports.ubuntu.com/pool/main/s/shadow/passwd_4.1.4.1-1ubuntu2.2_armel.deb
  Size/MD5:   845826 eab58be5d011f6e9cdca11f3d3031ab5

lpia architecture (Low Power Intel Architecture):

http://ports.ubuntu.com/pool/main/s/shadow/login_4.1.4.1-1ubuntu2.2_lpia.deb
  Size/MD5:   310598 de603be6f2e72a4f3086e8d5851505be
http://ports.ubuntu.com/pool/main/s/shadow/passwd_4.1.4.1-1ubuntu2.2_lpia.deb
  Size/MD5:   878912 ec0a4cfb27bc68adeca780e997b5d5aa

powerpc architecture (Apple Macintosh G3/G4/G5):

http://ports.ubuntu.com/pool/main/s/shadow/login_4.1.4.1-1ubuntu2.2_powerpc.deb
  Size/MD5:   316752 1b15b43bca6e7bd1454fafad22ea9aad
http://ports.ubuntu.com/pool/main/s/shadow/passwd_4.1.4.1-1ubuntu2.2_powerpc.deb
  Size/MD5:   905518 6b5100df7648271fdb6427a75c08d8c4

sparc architecture (Sun SPARC/UltraSPARC):

http://ports.ubuntu.com/pool/main/s/shadow/login_4.1.4.1-1ubuntu2.2_sparc.deb
  Size/MD5:   315378 a9670dab758ba0cf07194c51b13f3648
http://ports.ubuntu.com/pool/main/s/shadow/passwd_4.1.4.1-1ubuntu2.2_sparc.deb
  Size/MD5:   888354 e9dd9dd30efa1a744f824b0fa4cbc809

Updated packages for Ubuntu 10.04 LTS:

Source archives:

http://security.ubuntu.com/ubuntu/pool/main/s/shadow/shadow_4.1.4.2-1ubuntu2.2.diff.gz
  Size/MD5:    81829 877012c903d9fdcce5d77f017f2f0584
http://security.ubuntu.com/ubuntu/pool/main/s/shadow/shadow_4.1.4.2-1ubuntu2.2.dsc
  Size/MD5:     2349 788910a4c21d47240c4540f597c3fd72
http://security.ubuntu.com/ubuntu/pool/main/s/shadow/shadow_4.1.4.2.orig.tar.gz
  Size/MD5:  2814130 0d9a6f7b631f3f3673c263685a0a6ab3

amd64 architecture (Athlon64, Opteron, EM64T Xeon):

http://security.ubuntu.com/ubuntu/pool/main/s/shadow/login_4.1.4.2-1ubuntu2.2_amd64.deb
  Size/MD5:   323954 3c8b86ff34b431a45bfa0bf24478142f
http://security.ubuntu.com/ubuntu/pool/main/s/shadow/passwd_4.1.4.2-1ubuntu2.2_amd64.deb
  Size/MD5:   953290 60cd08b5dde3b45130d6828e9c6db01d

i386 architecture (x86 compatible Intel/AMD):

http://security.ubuntu.com/ubuntu/pool/main/s/shadow/login_4.1.4.2-1ubuntu2.2_i386.deb
  Size/MD5:   316222 4b6a57b7eeacf397636968ea58281df2
http://security.ubuntu.com/ubuntu/pool/main/s/shadow/passwd_4.1.4.2-1ubuntu2.2_i386.deb
  Size/MD5:   880966 7332752fb2e57abc7132417ed1ad06f8

armel architecture (ARM Architecture):

http://ports.ubuntu.com/pool/main/s/shadow/login_4.1.4.2-1ubuntu2.2_armel.deb
  Size/MD5:   312008 8484b8f77c40cda30024411f03ca4f6e
http://ports.ubuntu.com/pool/main/s/shadow/passwd_4.1.4.2-1ubuntu2.2_armel.deb
  Size/MD5:   829560 9f8db25cb484127c429a9674fdabbb10

powerpc architecture (Apple Macintosh G3/G4/G5):

http://ports.ubuntu.com/pool/main/s/shadow/login_4.1.4.2-1ubuntu2.2_powerpc.deb
  Size/MD5:   321074 bc4e6014a69cb9ffddc65848e5212fb5
http://ports.ubuntu.com/pool/main/s/shadow/passwd_4.1.4.2-1ubuntu2.2_powerpc.deb
  Size/MD5:   911044 0b8e35f307352f016cdb4631ab784ad8

sparc architecture (Sun SPARC/UltraSPARC):

http://ports.ubuntu.com/pool/main/s/shadow/login_4.1.4.2-1ubuntu2.2_sparc.deb
  Size/MD5:   320850 3e556c22497e3bf24c6e564cbc3a3584
http://ports.ubuntu.com/pool/main/s/shadow/passwd_4.1.4.2-1ubuntu2.2_sparc.deb
  Size/MD5:   905208 3509d3258ea5cd7ff039b40395a8984b

Updated packages for Ubuntu 10.10:

Source archives:

http://security.ubuntu.com/ubuntu/pool/main/s/shadow/shadow_4.1.4.2-1ubuntu3.2.diff.gz
  Size/MD5:    83284 485ba5d567bcbb68a685dd8f9f40eaac
http://security.ubuntu.com/ubuntu/pool/main/s/shadow/shadow_4.1.4.2-1ubuntu3.2.dsc
  Size/MD5:     2349 a177312225cbe835e8254594f4111d07
http://security.ubuntu.com/ubuntu/pool/main/s/shadow/shadow_4.1.4.2.orig.tar.gz
  Size/MD5:  2814130 0d9a6f7b631f3f3673c263685a0a6ab3

amd64 architecture (Athlon64, Opteron, EM64T Xeon):

http://security.ubuntu.com/ubuntu/pool/main/s/shadow/login_4.1.4.2-1ubuntu3.2_amd64.deb
  Size/MD5:   323220 24e39284c75d8bc4843fe1b50fd4af8f
http://security.ubuntu.com/ubuntu/pool/main/s/shadow/passwd_4.1.4.2-1ubuntu3.2_amd64.deb
  Size/MD5:   947490 23d90978d09f4eb69da19f0d69e01ec0

i386 architecture (x86 compatible Intel/AMD):

http://security.ubuntu.com/ubuntu/pool/main/s/shadow/login_4.1.4.2-1ubuntu3.2_i386.deb
  Size/MD5:   315420 4248e3f5a3c8907827638495aa297f4c
http://security.ubuntu.com/ubuntu/pool/main/s/shadow/passwd_4.1.4.2-1ubuntu3.2_i386.deb
  Size/MD5:   874946 458018527de7ce63d32d64df46642c2e

armel architecture (ARM Architecture):

http://ports.ubuntu.com/pool/main/s/shadow/login_4.1.4.2-1ubuntu3.2_armel.deb
  Size/MD5:   315662 8893fec2e8edcc2d8bdfe561c2b45668
http://ports.ubuntu.com/pool/main/s/shadow/passwd_4.1.4.2-1ubuntu3.2_armel.deb
  Size/MD5:   814020 b07e09efc999c9740e173fbd13a1b7ed

powerpc architecture (Apple Macintosh G3/G4/G5):

http://ports.ubuntu.com/pool/main/s/shadow/login_4.1.4.2-1ubuntu3.2_powerpc.deb
  Size/MD5:   320144 f42ca08e0edfe785e497212e15fc1fce
http://ports.ubuntu.com/pool/main/s/shadow/passwd_4.1.4.2-1ubuntu3.2_powerpc.deb
  Size/MD5:   904472 718775b17b340c8489f12945edb40ddb

Related

openvas 7
prion 1
debian 1
ubuntucve 1
slackware 1
securityvulns 2
nessus 4
osv 1
cve 1
debiancve 1
ubuntu 1
gentoo 1
openvas
openvas
Debian Security Advisory DSA 2164-1 (shadow)
2011-03-07 00:00:00
Ubuntu Update for shadow vulnerability USN-1065-1
2011-02-18 00:00:00
Ubuntu Update for shadow vulnerability USN-1065-1
2011-02-18 00:00:00
prion
prion
Crlf injection
2011-02-19 01:00:00
debian
debian
[SECURITY] [DSA 2164-1] shadow security update
2011-02-16 00:02:31
ubuntucve
ubuntucve
CVE-2011-0721
2011-02-15 00:00:00
slackware
slackware
[slackware-security] shadow
2011-03-27 23:18:49
securityvulns
securityvulns
passwd / shadow vulnerabilities
2011-02-18 00:00:00
[SECURITY] [DSA 2164-1] shadow security update
2011-02-17 00:00:00
nessus
nessus
Ubuntu 9.10 / 10.04 LTS / 10.10 : shadow vulnerability (USN-1065-1)
2011-02-16 00:00:00
Debian DSA-2164-1 : shadow - insufficient input sanitization
2011-02-20 00:00:00
Slackware 13.1 / current : shadow (SSA:2011-086-03)
2011-05-28 00:00:00
osv
osv
shadow - missing input sanitization
2011-02-16 00:00:00
cve
cve
CVE-2011-0721
2011-02-19 01:00:00
debiancve
debiancve
CVE-2011-0721
2011-02-19 01:00:00
ubuntu
ubuntu
shadow vulnerability
2011-02-15 00:00:00
gentoo
gentoo
Multiple packages, Multiple vulnerabilities fixed in 2011
2014-12-11 00:00:00
JSON
Related for SECURITYVULNS:DOC:25751
openvas7prion1debian1ubuntucve1slackware1securityvulns2nessus4osv1cve1debiancve1ubuntu1gentoo1