Description
useradd in shadow-utils before 4.0.3, and possibly other versions before 4.0.8, does not provide a required argument to the open function when creating a new user mailbox, which causes the mailbox to be created with unpredictable permissions and possibly allows attackers to read or modify the mailbox.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | shadow | 1:4.0.15-10 | — |
| Debian 13 | shadow | 1:4.0.15-10 | — |
| Debian 12 | shadow | 1:4.0.15-10 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | shadow-utils | 2:4.0.3-61.RHEL4 | RHSA-2007:0276 |
| RHEL 3 | shadow-utils | 2:4.0.3-29.RHEL3 | RHSA-2007:0431 |
Advisories 2
- RHSA-2007:0431 Red Hat Security Advisory: shadow-utils security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2007:0276 Red Hat Security Advisory: shadow-utils security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- 20070920 VMSA-2007-0006 Critical security updates for all supported versions of VMware ESX Server, VMware Server, VMware Workstation, VMware ACE, and VMware Player mailing-list
- 25098 third-party-advisory
- 25894 third-party-advisory
- RHSA-2007:0431 vendor-advisory
- ADV-2007-3229 vdb-entry
- 25267 third-party-advisory
- RHSA-2007:0276 vendor-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2007-249.htm
- 18111 vdb-entry
- 1018221 vdb-entry
- 25629 third-party-advisory
- http://cvs.pld.org.pl/shadow/NEWS?rev=1.109
- shadow-utils-useradd-file-permission(26958) vdb-entry
- VU#312692 third-party-advisory
- GLSA-200606-02 vendor-advisory
- 25896 third-party-advisory
- 20070511 rPSA-2007-0096-1 shadow mailing-list
- MDKSA-2006:090 vendor-advisory
- oval:org.mitre.oval:def:10807 vdb-entry signature
- 26909 third-party-advisory
- 27706 third-party-advisory
- ADV-2006-2006 vdb-entry
- https://issues.rpath.com/browse/RPL-1357
- 20506 third-party-advisory
- 20370 third-party-advisory