Alperen Keskin

**Name of the Vulnerable Software and Affected Versions** yast2-users versions prior to 5.0.9 **Description** An OS command injection issue exists when displaying the Password Settings tab of a user. The `get password term()` function in `src/include/users/dialogs.rb` retrieves the `shadowLastChange` and `shadowExpire` fields using `GetString()`, which lacks numeric validation. These strings are then passed to the `format days after epoch()` helper, which interpolates the values into a shell command executed via Ruby backticks without proper quoting or escaping. This allows an administrator managing users via an external or federated LDAP directory to trigger root command execution simply by viewing or editing a user entry. **Recommendations** Update yast2-users to version 5.0.9 or later.

**Name of the Vulnerable Software and Affected Versions** yast2-samba-client versions prior to 5.0.5 **Description** Improper neutralization of special elements used in an OS command allows an attacker to execute arbitrary commands as root on a machine being joined to a domain. This occurs when the attacker controls the content of an Active Directory directory tree, such as through a rogue domain controller or a directory user delegated the right to create objects. **Recommendations** Update yast2-samba-client to version 5.0.5 or later.

**Name of the Vulnerable Software and Affected Versions** yast2-auth-client (affected versions not specified) **Description** An OS command injection flaw exists in the `Auth::AuthConf` function within `src/lib/auth/authconf.rb`. The issue occurs when the software assembles Samba `net ads join`, `net ads lookup -S`, and `net ads testjoin` invocations by interpolating configuration values into a single command string. This string is then passed to `Open3.popen2` or `Open3.capture2`, causing Ruby to execute it via `/bin/sh`. An attacker who controls Active Directory configuration values can execute arbitrary commands as root on the host because the `ou` (Organizational Unit), `dnshostname`, AD user name, and AD domain name values are not validated or shell-quoted. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.