CVE-2018-16588: High severity shadow-utils vulnerability
Privilege escalation can occur in the SUSE useradd.c code in useradd, as distributed in the SUSE shadow package through 4.2.1-27.9.1 for SUSE Linux Enterprise 12 (SLE-12) and through 4.5-5.39 for SUSE Linux Enterprise 15 (SLE-15). Non-existing intermediate directories are created with mode 0777 during user creation. Given that they are world-writable, local attackers might use this for privilege escalation and other unspecified attacks. NOTE: this would affect non-SUSE users who took useradd.c code from a 2014-04-02 upstream pull request; however, no non-SUSE distribution is known to be affected.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-16588?
The severity of CVE-2018-16588 is high with a CVSS score of 7.8.
How does CVE-2018-16588 occur?
CVE-2018-16588 occurs due to privilege escalation in the SUSE useradd.c code.
Which software is affected by CVE-2018-16588?
The SUSE shadow package versions 4.2.1-27.9.1 and 4.5-5.39 for SUSE Linux Enterprise 12 (SLE-12) and SUSE Linux Enterprise 15 (SLE-15) are affected.
How can I fix CVE-2018-16588?
To fix CVE-2018-16588, update the SUSE shadow package to a version that includes the necessary security patches.
Where can I find more information about CVE-2018-16588?
More information about CVE-2018-16588 can be found at the following reference: http://lists.opensuse.org/opensuse-security-announce/2018-09/msg00073.html