CVE-2017-1000082
published 2017-07-07CVE-2017-1000082: systemd v233 and earlier fails to safely parse usernames starting with a numeric digit (e.g. "0day"), running the service in question with root privileges…
PriorityP352critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
3.88%
89.1th percentile
systemd v233 and earlier fails to safely parse usernames starting with a numeric digit (e.g. "0day"), running the service in question with root privileges rather than the user intended.
Affected
16 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | systemd | < systemd 246-2 (bookworm) | systemd 246-2 (bookworm) |
| debian | systemd | < systemd 234-1 (bookworm) | systemd 234-1 (bookworm) |
| fedoraproject | fedora | — | — |
| msrc | cbl_mariner_1.0_arm | — | — |
| msrc | cbl_mariner_1.0_x64 | — | — |
| msrc | cm1_systemd_239-34_on_cbl_mariner_1.0 | — | — |
| systemd_project | systemd | <= 245 | — |
| systemd_project | systemd | >= 0 < 246-2 | 246-2 |
| systemd_project | systemd | >= 0 < 234-1 | 234-1 |
| systemd_project | systemd | >= 0 < 246-2 | 246-2 |
| systemd_project | systemd | >= 0 < 234-1 | 234-1 |
| systemd_project | systemd | >= 0 < 246-2 | 246-2 |
| systemd_project | systemd | >= 0 < 234-1 | 234-1 |
| systemd_project | systemd | >= 0 < 246-2 | 246-2 |
| systemd_project | systemd | >= 0 < 234-1 | 234-1 |
| systemd_project | systemd | >= 229 < 234 | 234 |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
osv9.8CRITICAL
vendor_debian9.8LOW
vendor_redhat9.8CRITICAL
vendor_msrc6.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1
cisa_ics·2023-12-14
Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1
ICS Advisory
##
Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1
Release DateDecember 14, 2023
Alert CodeICSA-23-348-10
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v3 9.8
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Siemens
- Equipment: SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1
- Vulnerabilities: Improper Restriction of XML External Entity Reference, Time-of-check Time-of-use (TOCTOU) Race Condition, Command Injection, Miss
Microsoft
systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits as demonstrated by use of root privileges when privileges of the 0x0 user accou
vendor_msrc·2020-06-09·CVSS 6.7
CVE-2020-13776 [CRITICAL] CWE-269 systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits as demonstrated by use of root privileges when privileges of the 0x0 user accou
systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits as demonstrated by use of root privileges when privileges of the 0x0 user account were intended. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000082.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog p
Red Hat
systemd: Mishandles numerical usernames beginning with decimal digits or 0x followed by hexadecimal digits
vendor_redhat·2020-05-31·CVSS 9.8
CVE-2020-13776 [CRITICAL] CWE-440 systemd: Mishandles numerical usernames beginning with decimal digits or 0x followed by hexadecimal digits
systemd: Mishandles numerical usernames beginning with decimal digits or 0x followed by hexadecimal digits
systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits, as demonstrated by use of root privileges when privileges of the 0x0 user account were intended. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000082.
A flaw was found in systemd, where it mishandles numerical usernames beginning with decimal digits, or "0x" followed by hexadecimal digits. When the usernames are used by systemd, for example in service units, an unexpected user may be used instead. In some particular configurations, this flaw allows local attackers to elevate their privileges.
Statement: The flaw is rated as Moderate because
Debian
CVE-2020-13776: systemd - systemd through v245 mishandles numerical usernames such as ones composed of dec...
vendor_debian·2020·CVSS 9.8
CVE-2020-13776 [CRITICAL] CVE-2020-13776: systemd - systemd through v245 mishandles numerical usernames such as ones composed of dec...
systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits, as demonstrated by use of root privileges when privileges of the 0x0 user account were intended. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000082.
Scope: local
bookworm: resolved (fixed in 246-2)
bullseye: resolved (fixed in 246-2)
forky: resolved (fixed in 246-2)
sid: resolved (fixed in 246-2)
trixie: resolved (fixed in 246-2)
Red Hat
systemd: fails to parse usernames that start with digits
vendor_redhat·2017-07-07·CVSS 9.8
CVE-2017-1000082 [CRITICAL] CWE-20 systemd: fails to parse usernames that start with digits
systemd: fails to parse usernames that start with digits
systemd v233 and earlier fails to safely parse usernames starting with a numeric digit (e.g. "0day"), running the service in question with root privileges rather than the user intended.
Statement: For more information on the impact of numeric usernames in Red Hat Enterprise Linux, please see https://access.redhat.com/solutions/3103631
Package: systemd (Red Hat Enterprise Linux 7) - Not affected
Debian
CVE-2017-1000082: systemd - systemd v233 and earlier fails to safely parse usernames starting with a numeric...
vendor_debian·2017·CVSS 9.8
CVE-2017-1000082 [CRITICAL] CVE-2017-1000082: systemd - systemd v233 and earlier fails to safely parse usernames starting with a numeric...
systemd v233 and earlier fails to safely parse usernames starting with a numeric digit (e.g. "0day"), running the service in question with root privileges rather than the user intended.
Scope: local
bookworm: resolved (fixed in 234-1)
bullseye: resolved (fixed in 234-1)
forky: resolved (fixed in 234-1)
sid: resolved (fixed in 234-1)
trixie: resolved (fixed in 234-1)
GHSA
GHSA-g2fm-j5p3-x5h7: systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits, as demonstrated by use of ro
ghsa_unreviewed·2022-05-24·CVSS 9.8
CVE-2020-13776 [CRITICAL] CWE-269 GHSA-g2fm-j5p3-x5h7: systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits, as demonstrated by use of ro
systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits, as demonstrated by use of root privileges when privileges of the 0x0 user account were intended. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000082.
GHSA
GHSA-pp67-7cmm-9pp7: systemd v233 and earlier fails to safely parse usernames starting with a numeric digit (e
ghsa_unreviewed·2022-05-13
CVE-2017-1000082 [CRITICAL] CWE-269 GHSA-pp67-7cmm-9pp7: systemd v233 and earlier fails to safely parse usernames starting with a numeric digit (e
systemd v233 and earlier fails to safely parse usernames starting with a numeric digit (e.g. "0day"), running the service in question with root privileges rather than the user intended.
OSV
CVE-2020-13776: systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits, as demonstrated by use of ro
osv·2020-06-03·CVSS 9.8
CVE-2020-13776 [CRITICAL] CVE-2020-13776: systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits, as demonstrated by use of ro
systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits, as demonstrated by use of root privileges when privileges of the 0x0 user account were intended. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000082.
OSV
CVE-2017-1000082: systemd v233 and earlier fails to safely parse usernames starting with a numeric digit (e
osv·2017-07-07·CVSS 9.8
CVE-2017-1000082 [CRITICAL] CVE-2017-1000082: systemd v233 and earlier fails to safely parse usernames starting with a numeric digit (e
systemd v233 and earlier fails to safely parse usernames starting with a numeric digit (e.g. "0day"), running the service in question with root privileges rather than the user intended.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2020-13776 systemd: Mishandles numerical usernames beginning with decimal digits or 0x followed by hexadecimal digits
bugzilla·2020-06-09·CVSS 9.8
CVE-2020-13776 [CRITICAL] CVE-2020-13776 systemd: Mishandles numerical usernames beginning with decimal digits or 0x followed by hexadecimal digits
CVE-2020-13776 systemd: Mishandles numerical usernames beginning with decimal digits or 0x followed by hexadecimal digits
systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits, as demonstrated by use of root privileges when privileges of the 0x0 user account were intended. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000082.
Reference:
https://github.com/systemd/systemd/issues/15985
Discussion:
Created systemd tracking bugs for this issue:
Affects: fedora-all [bug 1845535]
---
Upstream fixes:
https://github.com/systemd/systemd/commit/156a5fd297b61bce31630d7a52c15614bf784843
https://github.com/systemd/systemd/commit/6495ceddf38aed2c9efdcf9d3440140190800b55
---
When a service uses the `User=` di
Bugzilla
CVE-2017-1000082 systemd: fails to parse usernames that start with digits [fedora-all]
bugzilla·2017-07-07·CVSS 9.8
CVE-2017-1000082 [CRITICAL] CVE-2017-1000082 systemd: fails to parse usernames that start with digits [fedora-all]
CVE-2017-1000082 systemd: fails to parse usernames that start with digits [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported
Bugzilla
CVE-2017-1000082 systemd: fails to parse usernames that start with digits
bugzilla·2017-07-07·CVSS 9.8
CVE-2017-1000082 [CRITICAL] CVE-2017-1000082 systemd: fails to parse usernames that start with digits
CVE-2017-1000082 systemd: fails to parse usernames that start with digits
Systemd version 323 rejects usernames starting with a digit (eg "0day"),
running the service with root privileges even though a corresponding user
exists.
Upstream bug:
https://github.com/systemd/systemd/issues/6237
oss-sec discussion:
http://www.openwall.com/lists/oss-security/2017/07/02/1
Discussion:
This issue seems to have been introduced since systemd-229. Neither EL7 nor Fedora 24 is affected - not sure about 231/233.
For an attacker to exploit this they would need to influence the creation of a user and associated unit file on the system.
---
Created systemd tracking bugs for this issue:
Affects: fedora-all [bug 1468430]
---
Statement:
For more information on the impact of numeric usernames in Re
http://www.openwall.com/lists/oss-security/2017/07/02/1http://www.securityfocus.com/bid/99507http://www.securitytracker.com/id/1038839https://github.com/systemd/systemd/issues/6237http://www.openwall.com/lists/oss-security/2017/07/02/1http://www.securityfocus.com/bid/99507http://www.securitytracker.com/id/1038839https://github.com/systemd/systemd/issues/6237
2017-07-07
Published