Bug 22010 - shadow-utils new security issue CVE-2017-12424
Summary: shadow-utils new security issue CVE-2017-12424
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 6
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA5TOO MGA6-64-OK MGA6-32-OK MGA5-64...
Keywords: advisory, has_procedure, validated_update
Depends on:
Blocks:
 
Reported: 2017-11-11 01:22 CET by David Walser
Modified: 2017-12-24 15:35 CET (History)
4 users (show)

See Also:
Source RPM: shadow-utils-4.4-1.mga6.src.rpm
CVE:
Status comment:


Attachments

Description David Walser 2017-11-11 01:22:48 CET
openSUSE has issued an advisory today (November 10):
https://lists.opensuse.org/opensuse-updates/2017-11/msg00030.html

The issue is fixed upstream in 4.5.

The SUSE bug contains a link to the upstream commit that fixed the issue:
https://bugzilla.suse.com/show_bug.cgi?id=1052261

Mageia 5 and Mageia 6 are also affected.
David Walser 2017-11-11 01:23:06 CET

Whiteboard: (none) => MGA6TOO, MGA5TOO

Marja Van Waes 2017-11-11 13:19:30 CET

CC: (none) => marja11
Assignee: bugsquad => basesystem

Comment 1 Mike Rambo 2017-12-21 15:57:39 CET
Patched package uploaded for cauldron, Mageia 6, and Mageia 5.

Advisory:
========================

Updated shadow-utils package fixes security vulnerability:

It was found that shadow-utils had a buffer overflow where if a buffer was left NULL for a cycle the next cycle would happily write past the entries buffer (CVE-2017-12424).


References:
https://nvd.nist.gov/vuln/detail/CVE-2017-12424
https://lists.opensuse.org/opensuse-updates/2017-11/msg00030.html
========================

Updated packages in core/updates_testing:
========================
shadow-utils-4.2.1-6.1.mga5

from shadow-utils-4.2.1-6.1.mga5.src.rpm

shadow-utils-4.4-1.1.mga6

from shadow-utils-4.4-1.1.mga6.src.rpm


Tested locally on cauldron, mga6/64, and mag5/32 before submitting to the build system.

Test procedure: https://bugs.mageia.org/show_bug.cgi?id=18984#c19

Whiteboard: MGA6TOO, MGA5TOO => MGA5TOO
Assignee: basesystem => qa-bugs
Version: Cauldron => 6
Keywords: (none) => has_procedure
CC: (none) => mrambo

Comment 2 Dave Hodgins 2017-12-22 08:28:18 CET
Just testing that the update installs cleanly and a few of the commands
such as pwck still work.

Validating the update

Whiteboard: MGA5TOO => MGA5TOO MGA6-64-OK MGA6-32-OK MGA5-64-OK MGA5-32-OK
Keywords: (none) => advisory, validated_update
CC: (none) => davidwhodgins, sysadmin-bugs

Comment 3 Mageia Robot 2017-12-22 11:32:00 CET
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2017-0465.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED

Comment 4 Mageia Robot 2017-12-24 15:35:00 CET
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2017-0465.html

Note You need to log in before you can comment on or make changes to this bug.