CVE-2018-1113 — Improper Authorization in Redhat Setup

CWE-285 — Improper AuthorizationCWE-732 — Incorrect Permission Assignment6 documents4 sources
Severity
5.3MEDIUMNVD
EPSS
0.0%
top 86.61%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Redhat SetupRedhat Enterprise Linux DesktopRedhat Enterprise Linux Server+1 more
Timeline
PublishedJul 3
Latest updateMay 13

Description

setup before version 2.11.4-1.fc28 in Fedora and Red Hat Enterprise Linux added /sbin/nologin and /usr/sbin/nologin to /etc/shells. This violates security assumptions made by pam_shells and some daemons which allow access based on a user's shell being listed in /etc/shells. Under some circumstances, users which had their shell changed to /sbin/nologin could still access the system.

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:LExploitability: 1.8 | Impact: 3.4

Affected Packages4 packages

▶NVDredhat/setup< 2.11.4

🔴Vulnerability Details

1
GHSA
GHSA-pj9f-pvw9-ffjc: setup before version 2↗2022-05-13
▶

📋Vendor Advisories

1
Red Hat
setup: nologin listed in /etc/shells violates security expectations↗2018-04-24
▶

💬Community

3
Bugzilla
CVE-2018-1113 setup: nologin listed in /etc/shells violates security expectations↗2018-04-24
▶
Bugzilla
CVE-2018-1113 setup: nologin listed in /etc/shells violates security expectations [fedora-all]↗2018-04-24
▶
Bugzilla
CVE-2018-1113 setup: nologin listed in /etc/shells violates security expectations [fedora-all]↗2016-09-23
▶