CVE-2002-2219 in chetcpasswd
Summary
by MITRE
chetcpasswd.cgi in Pedro Lineu Orso chetcpasswd before 2.1 allows remote attackers to read the last line of the shadow file via a long user (userid) field.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/29/2025
The vulnerability identified as CVE-2002-2219 affects the chetcpasswd.cgi web application component developed by Pedro Lineu Orso, specifically in versions prior to 2.1. This web-based utility is designed to provide web-based password management capabilities for Unix-like systems. The flaw manifests in how the application handles user identification fields during password modification processes, creating a significant information disclosure risk that can be exploited remotely by unauthenticated attackers.
The technical implementation of this vulnerability stems from improper input validation and handling within the chetcpasswd.cgi script. When a remote attacker submits a specially crafted user identifier field containing an excessively long string, the application fails to properly sanitize or limit the input length. This input processing error creates a buffer overflow condition or memory corruption scenario that allows the application to inadvertently expose the last line of the system's shadow file. The shadow file contains critical system security information including encrypted password hashes for user accounts, making this disclosure particularly dangerous for system security.
The operational impact of this vulnerability extends beyond simple information disclosure, as it provides attackers with potential credentials that could be used for further system compromise. The exposure of the last line of the shadow file means that attackers can obtain password hashes for one or more user accounts, potentially enabling them to perform offline password cracking attacks or directly use the compromised credentials for unauthorized access. This vulnerability affects the confidentiality and integrity of the system's authentication mechanisms, potentially allowing privilege escalation or complete system takeover. The remote exploitability means that attackers can leverage this vulnerability from any network location without requiring local system access or prior authentication.
This vulnerability aligns with CWE-20, "Improper Input Validation," and represents a classic example of how insufficient input length validation can lead to information disclosure attacks. The weakness directly maps to ATT&CK technique T1552.001, "Credentials In Files," as it enables attackers to extract password hashes from system files through web application exploitation. The vulnerability also relates to T1087.001, "Account Discovery," as it provides attackers with information about existing user accounts on the system. Organizations should implement immediate mitigations including upgrading to chetcpasswd version 2.1 or later, implementing proper input validation on user identifier fields, and restricting access to the chetcpasswd.cgi script through network segmentation or authentication mechanisms. Additionally, regular security audits of web applications should be conducted to identify similar input validation flaws that could potentially lead to information disclosure vulnerabilities.