CVE-2017-12424

What it actually does

The newusers tool in shadow allows malformed input to manipulate internal data structures, resulting in buffer overflows, memory corruption, crashes, or other unspecified behaviors that cross privilege boundaries in multi-tenant setups.

Why it matters to the business

In environments permitting unprivileged users to create subaccounts, this can enable unauthorized privilege escalation or denial of service, disrupting operations and risking data exposure in shared hosting or control-panel scenarios.

How an attack unfolds

An attacker with limited privileges submits specially crafted malformed input to newusers; the tool processes it incorrectly, corrupting memory and potentially allowing code execution or crashes that bypass intended security boundaries.

How to fix it

Upgrade shadow-maint/shadow to the fixed commit 954e3d2e7113e9ac06632aee3c69b8d818cc8952 or later; restrict unprivileged access to account-creation tools until patched.

How to confirm the fix worked

Confirm shadow version contains commit 954e3d2e7113e9ac06632aee3c69b8d818cc8952; test newusers with sample malformed inputs to verify absence of crashes or corruption.

Typical attack path

1. Gain access to an unprivileged account in a web-hosting control panel that invokes newusers
2. Craft and submit malformed input targeting newusers data structures
3. Trigger memory corruption or crash to attempt privilege escalation or denial of service

How to detect it

Review logs from account creation processes and newusers invocations for crash reports, segmentation faults, or malformed input patterns; check for unexpected privilege changes following account creation attempts.

What your security team should do

• Apply the fixed shadow version immediately due to high CVSS and privilege-boundary crossing
• Audit and restrict control-panel permissions that allow unprivileged account creation
• Monitor system logs for newusers crashes or unexpected terminations