rhsa-2003:058
Vulnerability from csaf_redhat
Published
2003-02-25 14:56
Modified
2024-11-21 22:39
Summary
Red Hat Security Advisory: shadow-utils security update
Notes
Topic
Updated shadow-utils packages are now available. These updated packages
correct a bug that caused the useradd tool to create mail spools with
incorrect permissions.
Details
The shadow-utils package includes programs for converting UNIX password
files to the shadow password format, plus programs for managing user and
group accounts. One of these programs is useradd, which is used to create
or update new user information.
When creating a user account, the version of useradd included in Red Hat
packages creates a mail spool file with incorrectly-set group ownership.
Instead of setting the file's group ownership to the "mail" group, it is
set to the user's primary group.
On systems where other users share the same primary group, this would allow
those users to be able to read and write other user mailboxes.
These errata packages contain an updated patch to useradd. Where a mail
group exists, mailboxes will be created with group mail having read and
write permissions. Otherwise the mailbox will be created without group
read and write permissions.
All users are advised to upgrade to these updated packages and also to
check the /var/spool/mail directory to ensure that mailboxes have correct
permissions.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "Updated shadow-utils packages are now available. These updated packages\ncorrect a bug that caused the useradd tool to create mail spools with\nincorrect permissions.", "title": "Topic" }, { "category": "general", "text": "The shadow-utils package includes programs for converting UNIX password\nfiles to the shadow password format, plus programs for managing user and\ngroup accounts. One of these programs is useradd, which is used to create\nor update new user information.\n\nWhen creating a user account, the version of useradd included in Red Hat\npackages creates a mail spool file with incorrectly-set group ownership.\nInstead of setting the file\u0027s group ownership to the \"mail\" group, it is\nset to the user\u0027s primary group.\n\nOn systems where other users share the same primary group, this would allow\nthose users to be able to read and write other user mailboxes.\n\nThese errata packages contain an updated patch to useradd. Where a mail\ngroup exists, mailboxes will be created with group mail having read and\nwrite permissions. Otherwise the mailbox will be created without group\nread and write permissions.\n\nAll users are advised to upgrade to these updated packages and also to\ncheck the /var/spool/mail directory to ensure that mailboxes have correct\npermissions.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2003:058", "url": "https://access.redhat.com/errata/RHSA-2003:058" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "84191", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=84191" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2003/rhsa-2003_058.json" } ], "title": "Red Hat Security Advisory: shadow-utils security update", "tracking": { "current_release_date": "2024-11-21T22:39:14+00:00", "generator": { "date": "2024-11-21T22:39:14+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2003:058", "initial_release_date": "2003-02-25T14:56:00+00:00", "revision_history": [ { "date": "2003-02-25T14:56:00+00:00", "number": "1", "summary": "Initial version" }, { "date": "2003-02-12T00:00:00+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-21T22:39:14+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ", "product": { "name": "Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ", "product_id": "Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:2.1::as" } } }, { "category": "product_name", "name": "Red Hat Linux Advanced Workstation 2.1", "product": { "name": "Red Hat Linux Advanced Workstation 2.1", "product_id": "Red Hat Linux Advanced Workstation 2.1", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:2.1::aw" } } } ], "category": "product_family", "name": "Red Hat Advanced Products" } ], "category": "vendor", "name": "Red Hat" } ] }, "vulnerabilities": [ { "cve": "CVE-2002-1509", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1616919" } ], "notes": [ { "category": "description", "text": "A patch for shadow-utils 20000902 causes the useradd command to create a mail spool files with read/write privileges of the new user\u0027s group (mode 660), which allows other users in the same group to read or modify the new user\u0027s incoming email.", "title": "Vulnerability description" }, { "category": "summary", "text": "security flaw", "title": "Vulnerability summary" } ], "product_status": { "fixed": [ "Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ", "Red Hat Linux Advanced Workstation 2.1" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2002-1509" }, { "category": "external", "summary": "RHBZ#1616919", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616919" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2002-1509", "url": "https://www.cve.org/CVERecord?id=CVE-2002-1509" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2002-1509", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1509" } ], "release_date": "2002-10-08T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2003-02-25T14:56:00+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nTo update all RPMs for your particular architecture, run:\n\nrpm -Fvh [filenames]\n\nwhere [filenames] is a list of the RPMs you wish to upgrade. Only those\nRPMs which are currently installed will be updated. Those RPMs which are\nnot installed but included in the list will not be updated. Note that you\ncan also use wildcards (*.rpm) if your current directory *only* contains the\ndesired RPMs.\n\nPlease note that this update is also available via Red Hat Network. Many\npeople find this an easier way to apply updates. To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.", "product_ids": [ "Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ", "Red Hat Linux Advanced Workstation 2.1" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2003:058" } ], "title": "security flaw" } ] }
Loading…
Loading…
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…