Skip to navigation

Security Advisory Low: shadow-utils security and bug fix update

Advisory: RHSA-2007:0431-4
Type: Security Advisory
Severity: Low
Issued on: 2007-06-11
Last updated on: 2007-06-11
Affected Products: Red Hat Desktop (v. 3)
Red Hat Enterprise Linux AS (v. 3)
Red Hat Enterprise Linux ES (v. 3)
Red Hat Enterprise Linux WS (v. 3)
CVEs (cve.mitre.org): CVE-2006-1174

Details

An updated shadow-utils package that fixes a security issue and several
bugs is now available.

This update has been rated as having low security impact by the Red Hat
Security Response Team.

The shadow-utils package includes the necessary programs for converting
UNIX password files to the shadow password format, as well as programs
for managing user and group accounts.

A flaw was found in the useradd tool in shadow-utils. A new user's
mailbox, when created, could have random permissions for a short period.
This could allow a local attacker to read or modify the mailbox.
(CVE-2006-1174)

This update also fixes the following bugs:

* shadow-utils debuginfo package was empty.

* chage.1 and chage -l gave incorrect information about sp_inact.

All users of shadow-utils are advised to upgrade to this updated
package, which contains backported patches to resolve these issues.


Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied. Use Red Hat
Network to download and update your packages. To launch the Red Hat
Update Agent, use the following command:

up2date

For information on how to install packages manually, refer to the
following Web page for the System Administration or Customization
guide specific to your system:

http://www.redhat.com/docs/manuals/enterprise/

Updated packages

Red Hat Desktop (v. 3)

SRPMS:
ftp://updates.redhat.com/rhn/repository/NULL/shadow-utils/4.0.3-29.RHEL3/SRPMS/shadow-utils-4.0.3-29.RHEL3.src.rpm
Missing file
    MD5: 966d844be451d09e732289fcf217af85
 
IA-32:
ftp://updates.redhat.com/rhn/repository/NULL/shadow-utils/4.0.3-29.RHEL3/i386/shadow-utils-4.0.3-29.RHEL3.i386.rpm
Missing file
    MD5: 70b7cf4df9bd1bee11c1f290ae3a1bbe
 
x86_64:
ftp://updates.redhat.com/rhn/repository/NULL/shadow-utils/4.0.3-29.RHEL3/x86_64/shadow-utils-4.0.3-29.RHEL3.x86_64.rpm
Missing file
    MD5: e6661e59bc80a8bb3f49566183a082a0
 
Red Hat Enterprise Linux AS (v. 3)

SRPMS:
ftp://updates.redhat.com/rhn/repository/NULL/shadow-utils/4.0.3-29.RHEL3/SRPMS/shadow-utils-4.0.3-29.RHEL3.src.rpm
Missing file
    MD5: 966d844be451d09e732289fcf217af85
 
IA-32:
ftp://updates.redhat.com/rhn/repository/NULL/shadow-utils/4.0.3-29.RHEL3/i386/shadow-utils-4.0.3-29.RHEL3.i386.rpm
Missing file
    MD5: 70b7cf4df9bd1bee11c1f290ae3a1bbe
 
IA-64:
ftp://updates.redhat.com/rhn/repository/NULL/shadow-utils/4.0.3-29.RHEL3/ia64/shadow-utils-4.0.3-29.RHEL3.ia64.rpm
Missing file
    MD5: 83ccf4e549535ebe265043c2ebdd6a40
 
PPC:
ftp://updates.redhat.com/rhn/repository/NULL/shadow-utils/4.0.3-29.RHEL3/ppc/shadow-utils-4.0.3-29.RHEL3.ppc.rpm
Missing file
    MD5: c686de929e196cd87b203e1ab85bbd01
 
s390:
ftp://updates.redhat.com/rhn/repository/NULL/shadow-utils/4.0.3-29.RHEL3/s390/shadow-utils-4.0.3-29.RHEL3.s390.rpm
Missing file
    MD5: 7badcd687970e0393547cac663e4d5b8
 
s390x:
ftp://updates.redhat.com/rhn/repository/NULL/shadow-utils/4.0.3-29.RHEL3/s390x/shadow-utils-4.0.3-29.RHEL3.s390x.rpm
Missing file
    MD5: cdd3cc34271e7b59c0374f03a46e8715
 
x86_64:
ftp://updates.redhat.com/rhn/repository/NULL/shadow-utils/4.0.3-29.RHEL3/x86_64/shadow-utils-4.0.3-29.RHEL3.x86_64.rpm
Missing file
    MD5: e6661e59bc80a8bb3f49566183a082a0
 
Red Hat Enterprise Linux ES (v. 3)

SRPMS:
ftp://updates.redhat.com/rhn/repository/NULL/shadow-utils/4.0.3-29.RHEL3/SRPMS/shadow-utils-4.0.3-29.RHEL3.src.rpm
Missing file
    MD5: 966d844be451d09e732289fcf217af85
 
IA-32:
ftp://updates.redhat.com/rhn/repository/NULL/shadow-utils/4.0.3-29.RHEL3/i386/shadow-utils-4.0.3-29.RHEL3.i386.rpm
Missing file
    MD5: 70b7cf4df9bd1bee11c1f290ae3a1bbe
 
IA-64:
ftp://updates.redhat.com/rhn/repository/NULL/shadow-utils/4.0.3-29.RHEL3/ia64/shadow-utils-4.0.3-29.RHEL3.ia64.rpm
Missing file
    MD5: 83ccf4e549535ebe265043c2ebdd6a40
 
x86_64:
ftp://updates.redhat.com/rhn/repository/NULL/shadow-utils/4.0.3-29.RHEL3/x86_64/shadow-utils-4.0.3-29.RHEL3.x86_64.rpm
Missing file
    MD5: e6661e59bc80a8bb3f49566183a082a0
 
Red Hat Enterprise Linux WS (v. 3)

SRPMS:
ftp://updates.redhat.com/rhn/repository/NULL/shadow-utils/4.0.3-29.RHEL3/SRPMS/shadow-utils-4.0.3-29.RHEL3.src.rpm
Missing file
    MD5: 966d844be451d09e732289fcf217af85
 
IA-32:
ftp://updates.redhat.com/rhn/repository/NULL/shadow-utils/4.0.3-29.RHEL3/i386/shadow-utils-4.0.3-29.RHEL3.i386.rpm
Missing file
    MD5: 70b7cf4df9bd1bee11c1f290ae3a1bbe
 
IA-64:
ftp://updates.redhat.com/rhn/repository/NULL/shadow-utils/4.0.3-29.RHEL3/ia64/shadow-utils-4.0.3-29.RHEL3.ia64.rpm
Missing file
    MD5: 83ccf4e549535ebe265043c2ebdd6a40
 
x86_64:
ftp://updates.redhat.com/rhn/repository/NULL/shadow-utils/4.0.3-29.RHEL3/x86_64/shadow-utils-4.0.3-29.RHEL3.x86_64.rpm
Missing file
    MD5: e6661e59bc80a8bb3f49566183a082a0
 

Bugs fixed (see bugzilla for more information)

176949 - shadow-utils-debuginfo is empty
216635 - chage does not show the Account Expires if its shadow field is 0.
229194 - CVE-2006-1174 shadow-utils mailbox creation race condition


References


Keywords

condition, mailbox, race


These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from:
https://www.redhat.com/security/team/key/#package

The Red Hat security contact is secalert@redhat.com. More contact details at http://www.redhat.com/security/team/contact/