CVE-2017-12424

In shadow before 4.5, the newusers tool could be made to manipulate internal data structures in ways unintended by the authors

published August 4, 2017

CVSS
—
EPSS
3%
Percentile
85.5
In the wild
Unconfirmed
What it is

⚠️ Watch out! The newusers tool in shadow versions before 4.5 lets crafty users juggle internal data like a circus performer — and it could lead to crashes! 🤹‍♂️ Think of it like a restaurant where customers can take over the kitchen. If someone manipulates the recipe book, they could create a dish that causes chaos in the kitchen, like a food poisoning outbreak or a broken kitchen appliance! An attacker could craft a sneaky input that leads to a buffer overflow or other memory corruption, potentially causing the system to crash or behave unpredictably. This could allow unprivileged users to gain access to sensitive data or functionality they shouldn't be touching, all while keeping their capes on! 🦸‍♀️

Put simply

Think of it like a restaurant where customers can take over the kitchen. If someone manipulates the recipe book, they could create a dish that causes chaos in the kitchen, like a food poisoning outbreak or a broken kitchen appliance! This vulnerability allows unprivileged users to manipulate internal data structures through malformed input, leading to crashes or unexpected behaviors in applications relying on the newusers tool.

What to do

An attacker could craft a sneaky input that leads to a buffer overflow or other memory corruption, potentially causing the system to crash or behave unpredictably. This could allow unprivileged users to gain access to sensitive data or functionality they shouldn't be touching, all while keeping their capes on! 🦸‍♀️ To address this, make sure to upgrade to shadow version 4.5 or later, where this issue is resolved. Additionally, review your user permissions to restrict access for untrusted accounts and consider implementing input validation to prevent malformed inputs. You've got this! By following these steps, you'll patch this vulnerability and keep your environment safe! 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02659 · 85.5th percentile
Published
2017-08-04T09:00Z
EPSS history
Timeline
  • 04 AUG 09:00Z
    In shadow before 4.5, the newusers tool could be made to manipulate internal data structures in ways unintended by the authors
    cvelistv5