PT-2002-1783 · Suse · Shadow

Published 2002-08-12 · Updated 2008-09-10 · CVE-2002-0762

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions shadow package in SuSE version 8.0

Description The issue allows local users to destroy the /etc/passwd and /etc/shadow files or assign extra group privileges to some users by changing filesize limits before calling programs that modify the files.

Recommendations For SuSE 8.0, consider restricting access to the shadow package until a fix is available, and avoid modifying the /etc/passwd and /etc/shadow files directly to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2002-0762

Affected Products

Shadow

References · 4

• http://novell.com/linux/security/advisories/2002_17_shadow.html · Vendor Advisory
• http://securityfocus.com/bid/4757 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2002-0762 · Security Note
• http://iss.net/security_center/static/9102.php · Vendor Advisory