Debian/Ubuntu是两款基于linux内核的操作系统。"chfn"和"chsh" 工具存在输入验证错误,其在更新GECOS字段时没有正确处理换行字符。攻击者可以利用此漏洞把任意内容增加到/etc/passwd文件或创建NIS用户或组。
Ubuntu Linux用户可参考如下供应商提供的安全补丁:Ubuntu Ubuntu Linux 9.10 sparcUbuntu login_4.1.4.1-1ubuntu2.2_sparc.debhttp://ports.ubuntu.com/pool/main/s/shadow/login_4.1.4.1-1ubuntu2.2_sp arc.debUbuntu passwd_4.1.4.1-1ubuntu2.2_sparc.debhttp://ports.ubuntu.com/pool/main/s/shadow/passwd_4.1.4.1-1ubuntu2.2_s parc.debUbuntu Ubuntu Linux 10.10 amd64Ubuntu passwd_4.1.4.2-1ubuntu3.2_amd64.debhttp://security.ubuntu.com/ubuntu/pool/main/s/shadow/passwd_4.1.4.2-1u buntu3.2_amd64.debUbuntu login_4.1.4.2-1ubuntu3.2_amd64.debhttp://security.ubuntu.com/ubuntu/pool/main/s/shadow/login_4.1.4.2-1ub untu3.2_amd64.debUbuntu Ubuntu Linux 10.04 powerpcUbuntu login_4.1.4.2-1ubuntu2.2_powerpc.debhttp://ports.ubuntu.com/pool/main/s/shadow/login_4.1.4.2-1ubuntu2.2_po werpc.debUbuntu passwd_4.1.4.2-1ubuntu2.2_powerpc.debhttp://ports.ubuntu.com/pool/main/s/shadow/passwd_4.1.4.2-1ubuntu2.2_p owerpc.debUbuntu Ubuntu Linux 9.10 i386Ubuntu login_4.1.4.1-1ubuntu2.2_i386.debhttp://security.ubuntu.com/ubuntu/pool/main/s/shadow/login_4.1.4.1-1ub untu2.2_i386.debUbuntu passwd_4.1.4.1-1ubuntu2.2_i386.debhttp://security.ubuntu.com/ubuntu/pool/main/s/shadow/passwd_4.1.4.1-1u buntu2.2_i386.debUbuntu Ubuntu Linux 10.04 amd64Ubuntu passwd_4.1.4.2-1ubuntu2.2_amd64.debhttp://security.ubuntu.com/ubuntu/pool/main/s/shadow/passwd_4.1.4.2-1u buntu2.2_amd64.debUbuntu login_4.1.4.2-1ubuntu2.2_amd64.debhttp://security.ubuntu.com/ubuntu/pool/main/s/shadow/login_4.1.4.2-1ub untu2.2_amd64.debUbuntu Ubuntu Linux 10.10 powerpcUbuntu login_4.1.4.2-1ubuntu3.2_powerpc.debhttp://ports.ubuntu.com/pool/main/s/shadow/login_4.1.4.2-1ubuntu3.2_po werpc.debUbuntu passwd_4.1.4.2-1ubuntu3.2_powerpc.debhttp://ports.ubuntu.com/pool/main/s/shadow/passwd_4.1.4.2-1ubuntu3.2_p owerpc.debUbuntu Ubuntu Linux 9.10 ARMUbuntu passwd_4.1.4.1-1ubuntu2.2_armel.debhttp://ports.ubuntu.com/pool/main/s/shadow/passwd_4.1.4.1-1ubuntu2.2_a rmel.debUbuntu login_4.1.4.1-1ubuntu2.2_armel.debhttp://ports.ubuntu.com/pool/main/s/shadow/login_4.1.4.1-1ubuntu2.2_ar mel.debUbuntu Ubuntu Linux 9.10 powerpcUbuntu passwd_4.1.4.1-1ubuntu2.2_powerpc.debhttp://ports.ubuntu.com/pool/main/s/shadow/passwd_4.1.4.1-1ubuntu2.2_p owerpc.debUbuntu login_4.1.4.1-1ubuntu2.2_powerpc.debhttp://ports.ubuntu.com/pool/main/s/shadow/login_4.1.4.1-1ubuntu2.2_po werpc.debUbuntu Ubuntu Linux 9.10 amd64Ubuntu login_4.1.4.1-1ubuntu2.2_amd64.debhttp://security.ubuntu.com/ubuntu/pool/main/s/shadow/login_4.1.4.1-1ub untu2.2_amd64.debUbuntu passwd_4.1.4.1-1ubuntu2.2_amd64.debhttp://security.ubuntu.com/ubuntu/pool/main/s/shadow/passwd_4.1.4.1-1u buntu2.2_amd64.debUbuntu Ubuntu Linux 10.04 ARMUbuntu login_4.1.4.2-1ubuntu2.2_armel.debhttp://ports.ubuntu.com/pool/main/s/shadow/login_4.1.4.2-1ubuntu2.2_ar mel.debUbuntu passwd_4.1.4.2-1ubuntu2.2_armel.debhttp://ports.ubuntu.com/pool/main/s/shadow/passwd_4.1.4.2-1ubuntu2.2_a rmel.debUbuntu Ubuntu Linux 10.10 ARMUbuntu login_4.1.4.2-1ubuntu3.2_armel.debhttp://ports.ubuntu.com/pool/main/s/shadow/login_4.1.4.2-1ubuntu3.2_ar mel.debUbuntu passwd_4.1.4.2-1ubuntu3.2_armel.debhttp://ports.ubuntu.com/pool/main/s/shadow/passwd_4.1.4.2-1ubuntu3.2_a rmel.debUbuntu Ubuntu Linux 10.10 i386Ubuntu login_4.1.4.2-1ubuntu3.2_i386.debhttp://security.ubuntu.com/ubuntu/pool/main/s/shadow/login_4.1.4.2-1ub untu3.2_i386.debUbuntu passwd_4.1.4.2-1ubuntu3.2_i386.debhttp://security.ubuntu.com/ubuntu/pool/main/s/shadow/passwd_4.1.4.2-1u buntu3.2_i386.debUbuntu Ubuntu Linux 9.10 lpiaUbuntu passwd_4.1.4.1-1ubuntu2.2_lpia.debhttp://ports.ubuntu.com/pool/main/s/shadow/passwd_4.1.4.1-1ubuntu2.2_l pia.debUbuntu login_4.1.4.1-1ubuntu2.2_lpia.debhttp://ports.ubuntu.com/pool/main/s/shadow/login_4.1.4.1-1ubuntu2.2_lp ia.debUbuntu Ubuntu Linux 10.04 sparcUbuntu login_4.1.4.2-1ubuntu2.2_sparc.debhttp://ports.ubuntu.com/pool/main/s/shadow/login_4.1.4.2-1ubuntu2.2_sp arc.debUbuntu passwd_4.1.4.2-1ubuntu2.2_sparc.debhttp://ports.ubuntu.com/pool/main/s/shadow/passwd_4.1.4.2-1ubuntu2.2_s parc.debUbuntu Ubuntu Linux 10.04 i386Ubuntu login_4.1.4.2-1ubuntu2.2_i386.debhttp://security.ubuntu.com/ubuntu/pool/main/s/shadow/login_4.1.4.2-1ub untu2.2_i386.debUbuntu passwd_4.1.4.2-1ubuntu2.2_i386.debhttp://security.ubuntu.com/ubuntu/pool/main/s/shadow/passwd_4.1.4.2-1u buntu2.2_i386.deb