[ GLSA 201805-09 ] Shadow

[GLSA]

Gentoo Linux Security Advisory

Title: Shadow: security bypass (GLSA 201805-09)
Severity: normal
Exploitable: remote
Date: 2018-05-22
Bug(s): #647790
ID: 201805-09

Synopsis

A vulnerability found in Shadow may allow local attackers to bypass
security restrictions.


Background

Shadow is a set of tools to deal with user accounts.

Affected Packages

Package: sys-apps/shadow
Vulnerable: < 4.6
Unaffected: >= 4.6
Architectures: All supported architectures


Description

A local attacker could possibly bypass security restrictions if an
administrator used “group blacklisting” to restrict access to file
system paths.


Impact

A local attacker could possibly bypass security restrictions.

Workaround

There is no known workaround at this time.

Resolution

All shadow users should upgrade to the latest version: