CRLF Injection Vulnerabilities in Shadow by The Shadow Project

CVE-2011-0721

Summary

Multiple CRLF injection vulnerabilities exist in the shadow suite, particularly in the chfn and chsh utilities. These weaknesses enable local users to manipulate the GECOS field, potentially altering the /etc/passwd file. Such actions may allow unauthorized additions of users or groups, compromising the integrity of user account management on the system.

References