CVE-2015-3246

This Metasploit module exploits a newline injection vulnerability in libuser and userhelper to gain root privileges by inserting a new user with UID=0 in /etc/passwd. It requires the current user's password and targets Red Hat-based systems.

This is a detailed advisory from Qualys describing two vulnerabilities (CVE-2015-3245 and CVE-2015-3246) in libuser and userhelper, including exploitation techniques for local privilege escalation via /etc/passwd manipulation. It explains the technical mechanics but does not include executable exploit code.

This Metasploit module exploits a newline injection vulnerability in libuser and userhelper to gain root privileges by inserting a new user with UID=0 in /etc/passwd. It uses the roothelper.c exploit from Qualys and has been tested on multiple Red Hat-based systems.