Exploitation Summary
EIP tracks 3 public exploits for CVE-2015-3246.
PoCs published by Metasploit, Qualys Corporation, Qualys, bcoles, including Metasploit module exploits/linux/local/libuser_roothelper_priv_esc.
AI-analyzed exploit summary This Metasploit module exploits a newline injection vulnerability in libuser and userhelper to gain root privileges by inserting a new user with UID=0 in /etc/passwd. It requires the current user's password and targets Red Hat-based systems.
Description
libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, directly modifies /etc/passwd, which allows local users to cause a denial of service (inconsistent file state) by causing an error during the modification. NOTE: this issue can be combined with CVE-2015-3245 to gain privileges.
Exploits (3)
This Metasploit module exploits a newline injection vulnerability in libuser and userhelper to gain root privileges by inserting a new user with UID=0 in /etc/passwd. It requires the current user's password and targets Red Hat-based systems.
This is a detailed advisory from Qualys describing two vulnerabilities (CVE-2015-3245 and CVE-2015-3246) in libuser and userhelper, including exploitation techniques for local privilege escalation via /etc/passwd manipulation. It explains the technical mechanics but does not include executable exploit code.
This Metasploit module exploits a newline injection vulnerability in libuser and userhelper to gain root privileges by inserting a new user with UID=0 in /etc/passwd. It uses the roothelper.c exploit from Qualys and has been tested on multiple Red Hat-based systems.