PT-2018-3774 · Gnu+4 · Shadow+4
Craig Furman
·
Publicado
2018-02-15
·
Atualizado
2024-06-15
·
CVE-2018-7169
CVSS v3.1
5.3
Média
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
shadow version 4.5
Description
An issue in the shadow utility allows an unprivileged user to be placed in a user namespace where setgroups(2) is permitted, enabling an attacker to remove themselves from a supplementary group. This may allow access to certain filesystem paths if the administrator has used group blacklisting to restrict access. The flaw reverts a security feature in the kernel to prevent privilege escalation.
Recommendations
For shadow version 4.5, at the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Incorrect Permission
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Astra Linux
Suse
Ubuntu
Shadow