低危 Debian/Ubuntu Linux 'shadow'包本地安全绕过漏洞

CVE编号

CVE-2011-0721

利用情况

暂无

补丁情况

官方补丁

披露时间

2011-02-19

漏洞描述

Debian/Ubuntu是两款基于linux内核的操作系统。"chfn"和"chsh" 工具存在输入验证错误，其在更新GECOS字段时没有正确处理换行字符。攻击者可以利用此漏洞把任意内容增加到/etc/passwd文件或创建NIS用户或组。

解决建议

Ubuntu Linux用户可参考如下供应商提供的安全补丁：Ubuntu Ubuntu Linux 9.10 sparcUbuntu login_4.1.4.1-1ubuntu2.2_sparc.debhttp://ports.ubuntu.com/pool/main/s/shadow/login_4.1.4.1-1ubuntu2.2_sp arc.debUbuntu passwd_4.1.4.1-1ubuntu2.2_sparc.debhttp://ports.ubuntu.com/pool/main/s/shadow/passwd_4.1.4.1-1ubuntu2.2_s parc.debUbuntu Ubuntu Linux 10.10 amd64Ubuntu passwd_4.1.4.2-1ubuntu3.2_amd64.debhttp://security.ubuntu.com/ubuntu/pool/main/s/shadow/passwd_4.1.4.2-1u buntu3.2_amd64.debUbuntu login_4.1.4.2-1ubuntu3.2_amd64.debhttp://security.ubuntu.com/ubuntu/pool/main/s/shadow/login_4.1.4.2-1ub untu3.2_amd64.debUbuntu Ubuntu Linux 10.04 powerpcUbuntu login_4.1.4.2-1ubuntu2.2_powerpc.debhttp://ports.ubuntu.com/pool/main/s/shadow/login_4.1.4.2-1ubuntu2.2_po werpc.debUbuntu passwd_4.1.4.2-1ubuntu2.2_powerpc.debhttp://ports.ubuntu.com/pool/main/s/shadow/passwd_4.1.4.2-1ubuntu2.2_p owerpc.debUbuntu Ubuntu Linux 9.10 i386Ubuntu login_4.1.4.1-1ubuntu2.2_i386.debhttp://security.ubuntu.com/ubuntu/pool/main/s/shadow/login_4.1.4.1-1ub untu2.2_i386.debUbuntu passwd_4.1.4.1-1ubuntu2.2_i386.debhttp://security.ubuntu.com/ubuntu/pool/main/s/shadow/passwd_4.1.4.1-1u buntu2.2_i386.debUbuntu Ubuntu Linux 10.04 amd64Ubuntu passwd_4.1.4.2-1ubuntu2.2_amd64.debhttp://security.ubuntu.com/ubuntu/pool/main/s/shadow/passwd_4.1.4.2-1u buntu2.2_amd64.debUbuntu login_4.1.4.2-1ubuntu2.2_amd64.debhttp://security.ubuntu.com/ubuntu/pool/main/s/shadow/login_4.1.4.2-1ub untu2.2_amd64.debUbuntu Ubuntu Linux 10.10 powerpcUbuntu login_4.1.4.2-1ubuntu3.2_powerpc.debhttp://ports.ubuntu.com/pool/main/s/shadow/login_4.1.4.2-1ubuntu3.2_po werpc.debUbuntu passwd_4.1.4.2-1ubuntu3.2_powerpc.debhttp://ports.ubuntu.com/pool/main/s/shadow/passwd_4.1.4.2-1ubuntu3.2_p owerpc.debUbuntu Ubuntu Linux 9.10 ARMUbuntu passwd_4.1.4.1-1ubuntu2.2_armel.debhttp://ports.ubuntu.com/pool/main/s/shadow/passwd_4.1.4.1-1ubuntu2.2_a rmel.debUbuntu login_4.1.4.1-1ubuntu2.2_armel.debhttp://ports.ubuntu.com/pool/main/s/shadow/login_4.1.4.1-1ubuntu2.2_ar mel.debUbuntu Ubuntu Linux 9.10 powerpcUbuntu passwd_4.1.4.1-1ubuntu2.2_powerpc.debhttp://ports.ubuntu.com/pool/main/s/shadow/passwd_4.1.4.1-1ubuntu2.2_p owerpc.debUbuntu login_4.1.4.1-1ubuntu2.2_powerpc.debhttp://ports.ubuntu.com/pool/main/s/shadow/login_4.1.4.1-1ubuntu2.2_po werpc.debUbuntu Ubuntu Linux 9.10 amd64Ubuntu login_4.1.4.1-1ubuntu2.2_amd64.debhttp://security.ubuntu.com/ubuntu/pool/main/s/shadow/login_4.1.4.1-1ub untu2.2_amd64.debUbuntu passwd_4.1.4.1-1ubuntu2.2_amd64.debhttp://security.ubuntu.com/ubuntu/pool/main/s/shadow/passwd_4.1.4.1-1u buntu2.2_amd64.debUbuntu Ubuntu Linux 10.04 ARMUbuntu login_4.1.4.2-1ubuntu2.2_armel.debhttp://ports.ubuntu.com/pool/main/s/shadow/login_4.1.4.2-1ubuntu2.2_ar mel.debUbuntu passwd_4.1.4.2-1ubuntu2.2_armel.debhttp://ports.ubuntu.com/pool/main/s/shadow/passwd_4.1.4.2-1ubuntu2.2_a rmel.debUbuntu Ubuntu Linux 10.10 ARMUbuntu login_4.1.4.2-1ubuntu3.2_armel.debhttp://ports.ubuntu.com/pool/main/s/shadow/login_4.1.4.2-1ubuntu3.2_ar mel.debUbuntu passwd_4.1.4.2-1ubuntu3.2_armel.debhttp://ports.ubuntu.com/pool/main/s/shadow/passwd_4.1.4.2-1ubuntu3.2_a rmel.debUbuntu Ubuntu Linux 10.10 i386Ubuntu login_4.1.4.2-1ubuntu3.2_i386.debhttp://security.ubuntu.com/ubuntu/pool/main/s/shadow/login_4.1.4.2-1ub untu3.2_i386.debUbuntu passwd_4.1.4.2-1ubuntu3.2_i386.debhttp://security.ubuntu.com/ubuntu/pool/main/s/shadow/passwd_4.1.4.2-1u buntu3.2_i386.debUbuntu Ubuntu Linux 9.10 lpiaUbuntu passwd_4.1.4.1-1ubuntu2.2_lpia.debhttp://ports.ubuntu.com/pool/main/s/shadow/passwd_4.1.4.1-1ubuntu2.2_l pia.debUbuntu login_4.1.4.1-1ubuntu2.2_lpia.debhttp://ports.ubuntu.com/pool/main/s/shadow/login_4.1.4.1-1ubuntu2.2_lp ia.debUbuntu Ubuntu Linux 10.04 sparcUbuntu login_4.1.4.2-1ubuntu2.2_sparc.debhttp://ports.ubuntu.com/pool/main/s/shadow/login_4.1.4.2-1ubuntu2.2_sp arc.debUbuntu passwd_4.1.4.2-1ubuntu2.2_sparc.debhttp://ports.ubuntu.com/pool/main/s/shadow/passwd_4.1.4.2-1ubuntu2.2_s parc.debUbuntu Ubuntu Linux 10.04 i386Ubuntu login_4.1.4.2-1ubuntu2.2_i386.debhttp://security.ubuntu.com/ubuntu/pool/main/s/shadow/login_4.1.4.2-1ub untu2.2_i386.debUbuntu passwd_4.1.4.2-1ubuntu2.2_i386.debhttp://security.ubuntu.com/ubuntu/pool/main/s/shadow/passwd_4.1.4.2-1u buntu2.2_i386.deb

参考链接
http://osvdb.org/70895
http://secunia.com/advisories/42505
http://secunia.com/advisories/43345
http://slackware.com/security/viewer.php?l=slackware-security&y=2011&m=slackw...
http://www.debian.org/security/2011/dsa-2164
http://www.securityfocus.com/bid/46426
http://www.ubuntu.com/usn/USN-1065-1
http://www.vupen.com/english/advisories/2011/0396
http://www.vupen.com/english/advisories/2011/0398
http://www.vupen.com/english/advisories/2011/0773
https://exchange.xforce.ibmcloud.com/vulnerabilities/65564

受影响软件情况

#	类型	厂商	产品	版本	影响面
1
	运行在以下环境
	应用	debian	shadow	1	-
	运行在以下环境
	系统	debian_10	shadow	*		Up to (excluding) 1:4.1.4.2+svn3283-3
	运行在以下环境
	系统	debian_11	shadow	*		Up to (excluding) 1:4.1.4.2+svn3283-3
	运行在以下环境
	系统	debian_12	shadow	*		Up to (excluding) 1:4.1.4.2+svn3283-3
	运行在以下环境
	系统	debian_6	shadow	*		Up to (excluding) 1:4.1.4.2+svn3283-2+squeeze1
	运行在以下环境
	系统	debian_sid	shadow	*		Up to (excluding) 1:4.1.4.2+svn3283-3

阿里云评分 3.5

• 攻击路径 本地
• 攻击复杂度 容易
• 权限要求 无需权限
• 影响范围 有限影响
• EXP成熟度 N/A
• 补丁情况 官方补丁
• 数据保密性 无影响
• 数据完整性 传输被破坏
• 服务器危害 DoS
• 全网数量 N/A

CWE-ID	漏洞类型
CWE-20	输入验证不恰当

Exp相关链接

- avd.aliyun.com