Vulnerability Details : CVE-2015-3245

Public exploit exists!
Incomplete blacklist vulnerability in the chfn function in libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, allows local users to cause a denial of service (/etc/passwd corruption) via a newline character in the GECOS field.
Published 2015-08-11 14:59:06
Updated 2023-02-13 00:48:56
Source Red Hat, Inc.
View at NVD,   CVE.org
Vulnerability category: Input validationDenial of service

Exploit prediction scoring system (EPSS) score for CVE-2015-3245

EPSS FAQ
0.04%
Probability of exploitation activity in the next 30 days EPSS Score History
~ 6 %
Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2015-3245

  • Libuser roothelper Privilege Escalation
    Disclosure Date: 2015-07-24
    First seen: 2020-04-26
    exploit/linux/local/libuser_roothelper_priv_esc
    This module attempts to gain root privileges on Red Hat based Linux systems, including RHEL, Fedora and CentOS, by exploiting a newline injection vulnerability in libuser and userhelper versions prior to 0.56.13-8 and version 0.60 before 0.60-7. Th

CVSS scores for CVE-2015-3245

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Score Source First Seen
2.1
 LOW AV:L/AC:L/Au:N/C:N/I:N/A:P
3.9
2.9
 NIST

CWE ids for CVE-2015-3245

  • The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
    Assigned by: nvd@nist.gov (Primary)

References for CVE-2015-3245

Products affected by CVE-2015-3245

This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!
Accept Close