CVE-2013-4235

This package includes the necessary programs for converting plain password files to the shadow password format and to manage user and group accounts

Security Fix(es):

shadow: TOCTOU (time-of-check time-of-use) race condition when copying and removing directory trees(CVE-2013-4235)

Tools for managing accounts and shadow password files.

Security Fix(es):

shadow: TOCTOU (time-of-check time-of-use) race condition when copying and removing directory trees(CVE-2013-4235)

Tools for managing accounts and shadow password files.

Security Fix(es):

shadow: TOCTOU (time-of-check time-of-use) race condition when copying and removing directory trees(CVE-2013-4235)

Tools for managing accounts and shadow password files.

Security Fix(es):

shadow: TOCTOU (time-of-check time-of-use) race condition when copying and removing directory trees(CVE-2013-4235)

Tools for managing accounts and shadow password files.

Security Fix(es):

shadow: TOCTOU (time-of-check time-of-use) race condition when copying and removing directory trees(CVE-2013-4235)

shadow: TOCTOU (time-of-check time-of-use) race condition when copying and removing directory trees

• SECURITY UPDATE: Race condition when copying and removing directory trees
  • debian/patches/CVE-2013-4235.patch: fix races in chown_tree(), remove_tree() and copy_tree()
  • CVE-2013-4235

shadow: TOCTOU (time-of-check time-of-use) race condition when copying and removing directory trees. (CVE-2013-4235)

These are all security issues fixed in the libsubid-devel-4.11.1-1.1 package on the GA media of openSUSE Tumbleweed.

This update for shadow fixes the following issues:

shadow is updated to 4.17.2 to bring lots of features and bug fixes.

• util-linux-2.41 introduced new variable: LOGIN_ENV_SAFELIST. Recognize it and update dependencies.

• Set SYS_{UID,GID}_MIN to 201: After repeated similar requests to change the ID ranges we set the above mentioned value to 201. The max value will stay at 499. This range should be sufficient and will give us leeway for the future. It's not straightforward to find out which static UIDs/GIDs are used in all packages.

Update to 4.17.2:

• src/login_nopam.c: Fix compiler warnings #1170
• lib/chkname.c: Put limits for LOGIN_NAME_MAX and sysconf(_SC_LOGIN_NAME_MAX) #1169
• Use HTTPS in link to Wikipedia article on password strength #1164
• lib/attr.h: use C23 attributes only with gcc >= 10 #1172
• login: Fix no-pam authorization regression #1174
• man: Add Portuguese translation #1178
• Update French translation #1177
• Add cheap defense mechanisms #1171
• Add Romanian translation #1176

Update to 4.17.1:

• Fix su - regression #1163

Update to 4.17.0:

• Fix the lower part of the domain of csrand_uniform()
• Fix use of volatile pointer
• Use str2[u]l() instead of atoi(3)
• Use a2i() in various places
• Fix const correctness
• Use uid_t for holding UIDs (and GIDs)
• Move all sprintf(3)-like APIs to a subdirectory
• Move all copying APIs to a subdirectory
• Fix forever loop on ENOMEM
• Fix REALLOC() nmemb calculation
• Remove id(1)
• Remove groups(1)
• Use local time for human-readable dates
• Use %F instead of %Y-%m-%d with strftime(3)
• is_valid{user,group}_name(): Set errno to distinguish the reasons
• Recommend --badname only if it is useful
• Add fmkomstemp() to fix mode of /etc/default/useradd
• Fix use-after-free bug in sgetgrent()
• Update Catalan translation
• Remove references to cppw, cpgr
• groupadd, groupmod: Update gshadow file with -U
• Added option -a for listing active users only, optimized using if aflg,return
• Added information in lastlog man page for new option '-a'
• Plenty of code cleanup and clarifications

• Disable flushing sssd caches. The sssd's files provider is no longer available.

Update to 4.16.0:

• The shadow implementations of id(1) and groups(1) are deprecated in favor of the GNU coreutils and binutils versions. They will be removed in 4.17.0.
• The rlogind implementation has been removed.
• The libsubid major version has been bumped, since it now requires specification of the module's free() implementation.

Update to 4.15.1:

• Fix a bug that caused spurious error messages about unknown login.defs configuration options #967
• Adding checks for fd omission #964
• Use temporary stat buffer #974
• Fix wrong french translation #975

Update to 4.15.0

• libshadow:
  • Use utmpx instead of utmp. This fixes a regression introduced in 4.14.0.
  • Fix build error (parameter name omitted).
• Build system:
  • Link correctly with libdl.
  • Install pam configs for chpasswd(8) and newusers(8) when using ./configure --with-libpam --disable-account-tools-setuid.
  • Merge libshadow and libmisc into a single libshadow. This fixes problems in the linker, which were reported at least in Gentoo.
  • Fix build with musl libc.
  • Support out of tree builds
• useradd(8):
  • Set proper SELinux labels for def_usrtemplate

Update to 4.14.6:

• login(1):
  • Fix off-by-one bugs.
• passwd(1):
  • Don't silently truncate passwords of length >= 200 characters. Instead, accept a length of PASS_MAX, and reject longer ones.
• libshadow:
  • Fix calculation in strtoday(), which caused a wrong half-day offset in some cases (bsc#1176006)
  • Fix parsing of dates in get_date() (bsc#1176006)
  • Use utmpx instead of utmp. This fixes a regression introduced in 4.14.0.

Update to 4.14.5:

• Build system:
  • Fix regression introduced in 4.14.4, due to a typo. chgpasswd had been deleted from a Makefile variable, but it should have been …

This update for shadow fixes the following issues:

• CVE-2013-4235: Fixed a race condition when copying and removing directory trees (bsc#916845).

This update for shadow fixes the following issues:

• CVE-2013-4235: Fixed a race condition when copying and removing directory trees (bsc#916845).

This update for shadow fixes the following issues:

• CVE-2013-4235: Fixed a race condition when copying and removing directory trees (bsc#916845).

This update for shadow fixes the following issues:

• CVE-2013-4235: Fixed a race condition when copying and removing directory trees (bsc#916845).

This update for shadow fixes the following issues:

• CVE-2013-4235: Fixed a race condition when copying and removing directory trees (bsc#916845).

This update for shadow fixes the following issues:

• CVE-2013-4235: Fixed a race condition when copying and removing directory trees (bsc#916845).

This update for shadow fixes the following issues:

• Fixed not copying of skel files (bsc#1228770)

This update for shadow fixes the following issues:

• CVE-2013-4235: Fixed TOCTOU race condition (bsc#916845)

This update for shadow fixes the following issues:

• Fixed not copying of skel files (bsc#1228770)

This update for shadow fixes the following issues:

• Fixed not copying of skel files (bsc#1228770)

This update for shadow fixes the following issues:

• Fixed not copying of skel files (bsc#1228770)

This update for shadow fixes the following issues:

• Fixed not copying of skel files (bsc#1228770)

This update for shadow fixes the following issues:

• Fixed not copying of skel files (bsc#1228770)

Florian Weimer discovered that shadow was not properly copying and removing user directory trees, which could lead to a race condition. A local attacker could possibly use this issue to setup a symlink attack and alter or remove directories without authorization.