CVE-2015-3245
libuser < 0.56.13-8 and 0.60 < 0.60-7 - Denial of Service via GECOS Field Newline Injection
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2015-3245.
PoCs published by Metasploit, Qualys, bcoles, including Metasploit module exploits/linux/local/libuser_roothelper_priv_esc.
AI-analyzed exploit summary This Metasploit module exploits a newline injection vulnerability in libuser and userhelper to gain root privileges by inserting a new user with UID=0 in /etc/passwd. It requires the current user's password and targets Red Hat-based systems.
Description
Incomplete blacklist vulnerability in the chfn function in libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, allows local users to cause a denial of service (/etc/passwd corruption) via a newline character in the GECOS field.
Exploits (3)
This Metasploit module exploits a newline injection vulnerability in libuser and userhelper to gain root privileges by inserting a new user with UID=0 in /etc/passwd. It requires the current user's password and targets Red Hat-based systems.
This is a detailed technical analysis of CVE-2015-3245 and CVE-2015-3246, focusing on vulnerabilities in libuser and userhelper. It explains the root cause, exploitation techniques, and includes a proof-of-concept for privilege escalation via /etc/passwd manipulation.
This Metasploit module exploits a newline injection vulnerability in libuser and userhelper to gain root privileges by inserting a new user with UID=0 in /etc/passwd. It supports both live compilation and pre-compiled binaries for various Red Hat-based systems.