A library Linux system shows world-writable permissions on /etc/passwd or /etc/shadow-class files. What is the correct severity framing for that finding?
Select an answer to reveal the explanation.
Short Explanation
Leaving passwd or shadow world-writable is like taping the master key under the welcome mat. Those files underpin who can log in and with what hashes—weak perms are a five-alarm finding. Call it critical, not cosmetic.
Full Explanation
World-writable permissions on /etc/passwd or /etc/shadow-class files on a library Linux system are a critical misconfiguration: weak permissions on authentication databases enable account insertion, hash replacement, or related takeover themes. Severity should reflect immediate identity compromise potential.
These files are not meant to be world-writable for cron as cosmetic lint. The issue is not solely a missing firewall rule on port 22. Weak permissions do not prove SELinux is correctly denying all local privilege paths.
Exam caveat: verify whether the writable state is genuine and not an unusual alternate NSS setup before final severity language.
Operational check: inspect permissions and ownership on passwd/shadow-class files, capture evidence, and recommend immediate remediation and integrity monitoring. Alert library IT to treat this as an incident-adjacent configuration failure. In municipal operations, record the rationale in the engagement notes so future assessors know which control was chosen and which failure modes the rejected options would create for city services. Re-validate after the next maintenance window that the same finding class still applies under the estate's current patch and configuration baseline.