==========================================================Ubuntu Security Notice USN-1065-1         February 15, 2011
shadow vulnerability
CVE-2011-0721
==========================================================
A security issue affects the following Ubuntu releases:

Ubuntu 9.10
Ubuntu 10.04 LTS
Ubuntu 10.10

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 9.10:
  passwd                          1:4.1.4.1-1ubuntu2.2

Ubuntu 10.04 LTS:
  passwd                          1:4.1.4.2-1ubuntu2.2

Ubuntu 10.10:
  passwd                          1:4.1.4.2-1ubuntu3.2

In general, a standard system update will make all the necessary changes.

Details follow:

Kees Cook discovered that some shadow utilities did not correctly validate
user input. A local attacker could exploit this flaw to inject newlines into
the /etc/passwd file. If the system was configured to use NIS, this could
lead to existing NIS groups or users gaining or losing access to the system,
resulting in a denial of service or unauthorized access.


Updated packages for Ubuntu 9.10:

  Source archives:

          Size/MD5:    80909 51c66e9b503868bdedd54efe4928cfa3
          Size/MD5:     2349 aafbd5790c84b6d4c4ca8e26d5c22198
          Size/MD5:  2781704 9f7882c359156aef377cbe9ffac9353e

  amd64 architecture (Athlon64, Opteron, EM64T Xeon):

          Size/MD5:   320530 263ed41dfe971c3996b93b4497050089
          Size/MD5:   954262 c01298f5056b5a917106e294ca1872b8

  i386 architecture (x86 compatible Intel/AMD):

          Size/MD5:   311918 9e71b023fd5e25ce6c1e49d51debb33b
          Size/MD5:   875522 f0f66df1a33eeab27ced964bdd0e83b1

  armel architecture (ARM Architecture):

          Size/MD5:   313518 c2c22045cd6e83fbd524251b348799d8
          Size/MD5:   845826 eab58be5d011f6e9cdca11f3d3031ab5

  lpia architecture (Low Power Intel Architecture):

          Size/MD5:   310598 de603be6f2e72a4f3086e8d5851505be
          Size/MD5:   878912 ec0a4cfb27bc68adeca780e997b5d5aa

  powerpc architecture (Apple Macintosh G3/G4/G5):

          Size/MD5:   316752 1b15b43bca6e7bd1454fafad22ea9aad
          Size/MD5:   905518 6b5100df7648271fdb6427a75c08d8c4

  sparc architecture (Sun SPARC/UltraSPARC):

          Size/MD5:   315378 a9670dab758ba0cf07194c51b13f3648
          Size/MD5:   888354 e9dd9dd30efa1a744f824b0fa4cbc809

Updated packages for Ubuntu 10.04 LTS:

  Source archives:

          Size/MD5:    81829 877012c903d9fdcce5d77f017f2f0584
          Size/MD5:     2349 788910a4c21d47240c4540f597c3fd72
          Size/MD5:  2814130 0d9a6f7b631f3f3673c263685a0a6ab3

  amd64 architecture (Athlon64, Opteron, EM64T Xeon):

          Size/MD5:   323954 3c8b86ff34b431a45bfa0bf24478142f
          Size/MD5:   953290 60cd08b5dde3b45130d6828e9c6db01d

  i386 architecture (x86 compatible Intel/AMD):

          Size/MD5:   316222 4b6a57b7eeacf397636968ea58281df2
          Size/MD5:   880966 7332752fb2e57abc7132417ed1ad06f8

  armel architecture (ARM Architecture):

          Size/MD5:   312008 8484b8f77c40cda30024411f03ca4f6e
          Size/MD5:   829560 9f8db25cb484127c429a9674fdabbb10

  powerpc architecture (Apple Macintosh G3/G4/G5):

          Size/MD5:   321074 bc4e6014a69cb9ffddc65848e5212fb5
          Size/MD5:   911044 0b8e35f307352f016cdb4631ab784ad8

  sparc architecture (Sun SPARC/UltraSPARC):

          Size/MD5:   320850 3e556c22497e3bf24c6e564cbc3a3584
          Size/MD5:   905208 3509d3258ea5cd7ff039b40395a8984b

Updated packages for Ubuntu 10.10:

  Source archives:

          Size/MD5:    83284 485ba5d567bcbb68a685dd8f9f40eaac
          Size/MD5:     2349 a177312225cbe835e8254594f4111d07
          Size/MD5:  2814130 0d9a6f7b631f3f3673c263685a0a6ab3

  amd64 architecture (Athlon64, Opteron, EM64T Xeon):

          Size/MD5:   323220 24e39284c75d8bc4843fe1b50fd4af8f
          Size/MD5:   947490 23d90978d09f4eb69da19f0d69e01ec0

  i386 architecture (x86 compatible Intel/AMD):

          Size/MD5:   315420 4248e3f5a3c8907827638495aa297f4c
          Size/MD5:   874946 458018527de7ce63d32d64df46642c2e

  armel architecture (ARM Architecture):

          Size/MD5:   315662 8893fec2e8edcc2d8bdfe561c2b45668
          Size/MD5:   814020 b07e09efc999c9740e173fbd13a1b7ed

  powerpc architecture (Apple Macintosh G3/G4/G5):

          Size/MD5:   320144 f42ca08e0edfe785e497212e15fc1fce
          Size/MD5:   904472 718775b17b340c8489f12945edb40ddb

Ubuntu 1065-1: shadow vulnerability

February 15, 2011
Kees Cook discovered that some shadow utilities did not correctly validateuser input

Summary

Update Instructions

References

Severity
shadow vulnerability

Package Information

Related News

19.Laptop Bed Esm H320
2 - 3 min read
AlmaLinux 9.4 beta has been released and provides compelling reasons to consider it for desktop usage. While AlmaLinux is primarily known as a
32.Lock Code Circular Esm H320
2 - 3 min read
Linux admins and security practitioners face significant challenges in keeping their Linux systems secure amidst the constant threat of kernel bugs.
1.Penguin Landscape Esm H320
2 - 3 min read
A significant security threat, known as the Spectre v2 exploit, has been observed targeting Linux systems running on modern Intel processors. Let's
10.FingerPrint Locks Esm H320
2 - 3 min read
The recent release of I2P 2.5.0 , an anonymous P2P network that protects against online censorship, surveillance, and monitoring, has brought a slew
24.Key Code Esm H320
2 - 3 min read
The Akira ransomware group has extorted approximately $42 million from over 250 victims since January 1, 2024. The group initially focused on
5.ShakingHands Esm H320
2 - 3 min read
At The Linux Foundation's Open Source Summit North America , Linus Torvalds, the creator of Linux, discussed various topics related to Linux
30.Lock Globe Motherboard Esm H320
1 - 2 min read
The SPDX 3.0 release marks a significant milestone in software management, particularly for Linux admins, infosec professionals, internet security
11.Locks IsometricPattern Esm H320
2 - 3 min read
Open Source maintainers and developers have been warned about the continued wave of attacks aimed at project maintainers similar to those recently
Sign Up

Get the Latest News & Insights

Sign up to get the latest security news affecting Linux and open source delivered straight to your inbox.

© 2024 Guardian Digital, Inc All Rights Reserved