CVE-2011-0721 in shadow
Summary
by MITRE
Multiple CRLF injection vulnerabilities in (1) chfn and (2) chsh in shadow 1:4.1.4 allow local users to add new users or groups to /etc/passwd via the GECOS field.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/17/2021
The vulnerability described in CVE-2011-0721 represents a critical security flaw within the shadow package version 1:4.1.4 affecting the chfn and chsh utilities. These commands are fundamental system tools used for managing user account information, with chfn specifically designed to modify the GECOS field in /etc/passwd and chsh for changing the user's login shell. The vulnerability stems from insufficient input validation and sanitization within these utilities, creating opportunities for malicious input processing that can be exploited by local users to manipulate system user accounts.
The core technical flaw involves CRLF (Carriage Return Line Feed) injection vulnerabilities that occur when the chfn and chsh commands process user input without proper sanitization of special characters. When users provide input containing CRLF sequences within the GECOS field or shell specification, the applications fail to properly escape or validate these characters before writing to the /etc/passwd file. This improper handling allows attackers to inject additional user entries or modify existing records in the password database, effectively bypassing normal user management procedures and potentially enabling unauthorized account creation or modification.
From an operational impact perspective, this vulnerability poses significant risks to system security and integrity. Local users who can execute these commands gain the ability to manipulate the /etc/passwd file directly, which could lead to privilege escalation scenarios or account takeover attempts. The vulnerability is particularly dangerous because it operates at the system level where standard user permissions are typically sufficient to exploit the flaw. Attackers could potentially create new user accounts with elevated privileges or modify existing user records to gain persistent access to the system. The CRLF injection mechanism allows for precise manipulation of the password file structure, making it difficult to detect unauthorized modifications through standard audit mechanisms.
The vulnerability aligns with CWE-115, which describes improper handling of CRLF sequences, and represents a classic example of input validation failures that can lead to data injection attacks. From an attack framework perspective, this vulnerability maps to techniques described in the MITRE ATT&CK framework under T1068 for local privilege escalation and T1548 for account manipulation. The attack vector is particularly concerning because it leverages legitimate system utilities, making detection more challenging. Organizations should implement immediate mitigations including updating to patched versions of the shadow package, implementing proper input validation for user account management tools, and monitoring /etc/passwd file modifications for unauthorized changes. Additionally, system administrators should consider implementing mandatory access controls and regular security audits to detect potential exploitation attempts. The vulnerability demonstrates the critical importance of proper input sanitization in system utilities and highlights the need for comprehensive security testing of core operating system components.