bugTiger UNIX security tool - Bugs: bug #43336, Fix for missing escapes in...


bug #43336: Fix for missing escapes in check_accounts

Submitter:  None
Submitted:  Tue 30 Sep 2014 09:02:14 PM UTC
Category:  Security check modules Severity:  5-Critical
Item Group:  Script error Status:  Fixed
Privacy:  Public Assigned to:  jfs
Open/Closed:  Open Operating System:  Debian GNU/Linux
* Mandatory Fields

Add a New Comment Rich Markup

Sun 04 Feb 2018 01:21:01 PM UTC, comment #1: 

Thank you for spotting this bug, I have committed a patch to GIT fixing the escaping of this check.

Javier Fernandez-Sanguino Peña <jfs>
Group administrator
Tue 30 Sep 2014 09:02:14 PM UTC, original submission:  

In check_accounts in check_users() there is a check for shell init files which misses escapes for the quotes in the eval'd code.

Here is the patch:

--- /usr/lib/tiger/scripts/check_accounts 2012-04-18 19:45:35.000000000 +0200
+++ check_accounts 2014-09-30 22:50:51.765407045 +0200
@@ -303,7 +303,7 @@
        eval "
          case \"$shell\" in
-             [ ! -r "${home}/.${shell##*/}rc" ] && {
+             [ ! -r \"${home}/.${shell##*/}rc\" ] && {
                message WARN acc019w \"\" \"Login ID $user may be missing a shell initialization file ${home}/.${shell##*/}rc.\"



(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:

No files currently attached


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -email is unavailable- added by jfs (Posted a comment)

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.


    Follow 2 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2018-02-04 jfs StatusNone Fixed
        Assigned toNone jfs

    Back to the top

    Powered by Savane 3.13-4b48.
    Corresponding source code