Bug 1788452 (CVE-2019-19882)

Summary:	CVE-2019-19882 shadow-utils: local users can obtain root access because setuid programs are misconfigured
Product:	[Other] Security Response	Reporter:	Marian Rehak <mrehak>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	dapospis, dblechte, dfediuck, eedri, mgoldboi, michal.skrivanek, pkis, pvrabec, sbonazzo, sherold, tmraz, yturgema
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in shadow-utils. When compiled with --with-libpam, but without explicitly passing --disable-account-tools-setuid and suitable PAM configurations, a local user could obtain root access due to setuid being misconfigured. The highest threat from this vulnerability is to file confidentiality and integrity as well as system availability.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-01-07 12:52:18 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1788454

Description Marian Rehak 2020-01-07 09:29:05 UTC

Local users can obtain root access because setuid programs are misconfigured. This affects shadow 4.8 when compiled using --with-libpam but without explicitly passing --disable-account-tools-setuid, and without a PAM configuration suitable for use with setuid account management tools.

Upstream Issue:

https://github.com/shadow-maint/shadow/commit/edf7547ad5aa650be868cf2dac58944773c12d75

Comment 1 Tomas Mraz 2020-01-07 09:31:24 UTC

We do not compile shadow-utils with --with-libpam option.

Comment 3 Eric Christensen 2020-06-30 14:51:53 UTC

Statement:

This issue only affects the shadow-utils package when compiled with the "with-libpam" option. The shadow-utils package, as shipped by Red Hat, is not compiled with that option and is therefore not affected by this flaw.