[Pkg-shadow-devel] Bug#1034482: shadow: CVE-2023-29383

[Salvatore Bonaccorso]

Source: shadow
Version: 1:4.13+dfsg1-1
Severity: important
Tags: security upstream
Forwarded: https://github.com/shadow-maint/shadow/pull/687
X-Debbugs-Cc: carnil at debian.org, Debian Security Team <team at security.debian.org>

Hi,

The following vulnerability was published for shadow.

CVE-2023-29383[0]:
| In Shadow 4.13, it is possible to inject control characters into
| fields provided to the SUID program chfn (change finger). Although it
| is not possible to exploit this directly (e.g., adding a new user
| fails because \n is in the block list), it is possible to misrepresent
| the /etc/passwd file when viewed. Use of \r manipulations and Unicode
| characters to work around blocking of the : character make it possible
| to give the impression that a new user has been added. In other words,
| an adversary may be able to convince a system administrator to take
| the system offline (an indirect, social-engineered denial of service)
| by demonstrating that "cat /etc/passwd" shows a rogue user account.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2023-29383
    https://www.cve.org/CVERecord?id=CVE-2023-29383
[1] https://github.com/shadow-maint/shadow/pull/687
[2] https://github.com/shadow-maint/shadow/commit/e5905c4b84d4fb90aefcd96ee618411ebfac663d


Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore