PT-2003-1049 · Gnu · Shadow-Utils

Published 2003-02-20 · Updated 2008-09-10 · CVE-2002-1509

Positive Technologies (AI Summary)

CVSS v2.0

3.6

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions shadow-utils version 20000902

Description The issue allows other users in the same group to read or modify the new user's incoming email due to the creation of mail spool files with read/write privileges of the new user's group. This can lead to a violation of confidentiality and integrity of protected information. The exploitation of this issue can be carried out locally.

Recommendations For shadow-utils version 20000902, consider changing the permissions of the mail spool files to prevent other users in the same group from reading or modifying the new user's incoming email. As a temporary workaround, restrict access to the mail spool files until a patch is available.

Fix

Related Identifiers

BDU:2015-07786

CVE-2002-1509

Affected Products

Shadow-Utils

References · 7

• http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=75418 · Vendor Advisory
• http://mandrakesoft.com/security/advisories?name=MDKSA-2003:026 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-07786 · Security Note
• http://redhat.com/support/errata/RHSA-2003-058.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2003-057.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2002-1509 · Security Note
• https://rhn.redhat.com/errata/RHSA-2003-057.html · Note