TOCTOU Race Condition Vulnerability in Shadow Package
Summary
DEBIAN-CVE-2013-4235: shadow: TOCTOU (time-of-check time-of-use) race condition when copying and removing directory trees. Affects shadow versions < 1:4.12.3+dfsg1-1. Fixed in 1:4.12.3+dfsg1-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Shadow package is a suite of utilities for managing user accounts and passwords in Unix-like operating systems. It provides essential functionalities such as password management, user account creation, and login management. However, the Shadow package has been identified to have a vulnerability that can lead to security risks if not addressed promptly.
Vulnerability Detail
The vulnerability identified as DEBIAN-CVE-2013-4235 is a TOCTOU (time-of-check time-of-use) race condition that occurs when copying and removing directory trees. This flaw can potentially allow an attacker to exploit the race condition to manipulate file permissions or access sensitive data, leading to unauthorized actions within the system. The vulnerability affects multiple versions of the Shadow package across different Debian releases.
How To Fix
Minimum fixed version
1:4.12.3+dfsg1-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade shadowTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can limit access to the affected functionalities of the Shadow package until the update is applied. This may involve restricting user permissions or disabling certain features that utilize directory tree operations.
Conclusion
The TOCTOU race condition vulnerability in the Shadow package poses a significant risk to system security. It is crucial to update to the patched version to mitigate potential threats. Users should also consider using tools like Vulert to monitor their applications for vulnerabilities.
See every vulnerability recorded for shadow →
FAQ
A TOCTOU race condition is a type of vulnerability that occurs when a program checks a condition and then uses the result of that check, but an attacker can change the state of the system between these two actions.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities. By uploading your manifest file like package-lock.json, you can check if your application is affected by this vulnerability.
If exploited, this vulnerability could allow attackers to gain unauthorized access to sensitive files, escalate privileges, or execute arbitrary code, compromising the security of the system.
Yes, updating to version 1:4.12.3+dfsg1-1 or later will ensure that the vulnerability is patched and your system is secure.
If immediate updates are not possible, consider applying temporary workarounds such as restricting access to the affected functionalities until a proper fix can be implemented.
References
Related vulnerabilities
Recent vulnerabilities recorded for shadow.
