CVE-2023-29383: Low severity shadow project vulnerability
In Shadow 4.13, it is possible to inject control characters into fields provided to the SUID program chfn (change finger). Although it is not possible to exploit this directly (e.g., adding a new user fails because \n is in the block list), it is possible to misrepresent the /etc/passwd file when viewed. Use of \r manipulations and Unicode characters to work around blocking of the : character make it possible to give the impression that a new user has been added. In other words, an adversary may be able to convince a system administrator to take the system offline (an indirect, social-engineered denial of service) by demonstrating that "cat /etc/passwd" shows a rogue user account.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-29383?
CVE-2023-29383 has been assigned a severity rating that indicates it poses a risk of misrepresenting user data.
How do I fix CVE-2023-29383?
To mitigate CVE-2023-29383, upgrading to a patched version of Shadow beyond 4.13 is recommended.
What does CVE-2023-29383 exploit?
CVE-2023-29383 allows the injection of control characters into fields provided to the SUID program chfn.
Is CVE-2023-29383 exploitable?
CVE-2023-29383 is not directly exploitable to create new users but can misrepresent the /etc/passwd file in certain scenarios.
What software is affected by CVE-2023-29383?
Shadow version 4.13 is affected by CVE-2023-29383.