Red Hat Bugzilla – Bug 884658
CVE-2013-4235 shadow-utils: TOCTOU race conditions by copying and removing directory trees
Last modified: 2018-03-01 18:44:50 EST
A TOCTOU (time-of-check time-of-use) race condition was found in the way shadow-utils, collection of utilities for managing accounts and shadow password files, performed copying and removal of (user) directory trees. A local attacker, with permissions to write into particular directory, could use this flaw to conduct symbolic link attacks, leading to their ability to alter / remove directories outside of this directory (tree), if this directory was modified (copied or removed) via shadow-utils functionality. This issue was found by Florian Weimer of Red Hat Product Security Team.
This issue affects the versions of the shadow-utils package, as shipped with Red Hat Enterprise Linux 5 and 6. -- This issue affects the versions of the shadow-utils package, as shipped with Fedora release of 16 and 17.
I think this is very low severity problem - the case when the user's home directory is created is in general not real problem at all because when the user is added to the system he does not have password set yet and so he cannot log-in during the time he is added to the system when he could use this race to attack. And even if he would have the password set he would have to know when the system administrator calls the useradd exactly. The userdel and removing is just slightly more serious - but I'd expect the administrator to verify that the user does not have any running processes on the system before he tries to remove the user from the system.
(In reply to comment #6) > The userdel and removing is just slightly more serious - but I'd expect the > administrator to verify that the user does not have any running processes on > the system before he tries to remove the user from the system. I agree that these issues are not severe. But checking that a user is not logged in is not entirely sufficient because some directories to be removed could have 777 permissions (either accidentally or by design), so other users could participate in an attack.
Acknowledgments: Name: Florian Weimer (Red Hat Product Security Team)