On Thu, Nov 04, 2004 at 09:22:24PM +0100, Matthias Geerdsen wrote: > Severity: Low > Title: shadow: Unauthorized modification of account information [...] > A flaw in the chfn and chsh utilities might allow modification of > account properties by unauthorized users. [...] > A local attacker may be able to use chfn and chsh to change the > standard shell of other users or modify their GECOS information (full > name, phone number...). While you did correctly categorize this as "low" severity, the above description is not correct. It is not possible to use this on other users' accounts. Here's the description from Owl change log: 2004/06/09 Package: shadow-utils SECURITY FIX Severity: none to low, local, active Properly check the return value from pam_chauthtok(3) in chfn(1) and chsh(1). Previously, if chfn and/or chsh commands would be enabled for non-privileged users with control(8), it would have been possible for a logged in user with an expired password to change their "Full Name" and login shell without having to change the password. Thanks to Steve Grubb and Martin Schulze for discovering this problem. The only bug here is that chfn/chsh did not properly force a change of an expired password, yet permitted the requested change of GECOS info or login shell to be performed. This is hardly worth an advisory. In fact, it might not have been worth our change log entry either... -- Alexander Peslyak <solar at openwall.com> GPG key ID: B35D3598 fp: 6429 0D7E F130 C13E C929 6447 73C3 A290 B35D 3598 http://www.openwall.com - bringing security into open computing environments
