Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.2

shadow login can let local users overwrite files

CVE-2008-5394 · published 17 years ago
Summary

The login program included with the shadow package on Debian (and similar Linux systems) lets users who belong to a certain system group replace any file they choose by tricking the program into following a symbolic link. This can let a malicious insider modify important system files, potentially compromising the server. Update the shadow package to the latest version or restrict group membership to trusted users.

What to do
  • Update debian shadow to version 1:4.1.1-6.
Affected software
Ecosystem VendorProductAffected versions
Debian:12 debian shadow < 1:4.1.1-6
Fix: upgrade to 1:4.1.1-6
Debian:13 debian shadow < 1:4.1.1-6
Fix: upgrade to 1:4.1.1-6
Debian:14 debian shadow < 1:4.1.1-6
Fix: upgrade to 1:4.1.1-6
– debian shadow 4.0.18.1
cpe:2.3:a:debian:shadow:4.0.18.1:*:*:*:*:*:*:*
Original advisory text
/bin/login in shadow 4.0.18.1 in Debian GNU/Linux, and probably other Linux distributions, allows local users in the utmp group to overwrite arbitrary files via a symlink attack on a temporary file...
/bin/login in shadow 4.0.18.1 in Debian GNU/Linux, and probably other Linux distributions, allows local users in the utmp group to overwrite arbitrary files via a symlink attack on a temporary file referenced in a line (aka ut_line) field in a utmp entry.
References
Severity
7.2 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-59Link Following
Timeline
Published9 Dec 2008
Updated3 Nov 2026
First seen20 Sep 2026
Sources
DEBIAN-CVE-2008-5394 · OSV
CVE-2008-5394 · NVD
Track software like this
Free during beta