830486 – (CVE-2013-4235) <sys-apps/shadow-4.11.1: TOCTOU race condition in usermod/userdel (CVE-2013-4235)

Bug 830486 (CVE-2013-4235) - <sys-apps/shadow-4.11.1: TOCTOU race condition in usermod/userdel (CVE-2013-4235)

Summary: <sys-apps/shadow-4.11.1: TOCTOU race condition in usermod/userdel (CVE-2013-4...

Status:	IN_PROGRESS

Alias:	CVE-2013-4235

Product:	Gentoo Security
Classification:	Unclassified
Component:	Vulnerabilities (show other bugs)
Hardware:	All Linux

Importance:	Normal normal (vote)
Assignee:	Gentoo Security

URL:
Whiteboard:	B3 [glsa?]
Keywords:

Depends on:	831980
Blocks:
	Show dependency tree

Reported:	2022-01-03 05:07 UTC by Sam James
Modified:	2022-04-17 17:19 UTC (History)
CC List:	1 user (show)

See Also:
Package list:
Runtime testing required:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Sam James archtester

2022-01-03 05:07:26 UTC

A TOCTOU race condition was discovered in shadow-utils. A local attacker with write privileges in a directory removed or copied by usermod/userdel could potentially exploit this flaw, when the administrator invokes usermod/userdel, to delete or modify other files on the system.