UBUNTU-CVE-2015-3245: Low severity ubuntu/libuser vulnerability

Q: Who can exploit this issue?

A local user can exploit it through the chfn function as used by the userhelper program in the usermode package. Remote exploitation is not indicated by the available information.

Q: What input is required to trigger the denial of service?

The attacker needs to place a newline character in the GECOS field. The incomplete blacklist permits this input and can result in corruption of /etc/passwd.

Q: Which libuser versions are affected?

The issue affects libuser versions before 0.56.13-8 and versions before 0.60-7.

Published Aug 11, 2015

Updated

Incomplete blacklist vulnerability in the chfn function in libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, allows local users to cause a denial of service (/etc/passwd corruption) via a newline character in the GECOS field.

Affected Software

3 affected componentsFixes available

ubuntu/libuser<1:0.56.9.dfsg.1-1.2ubuntu2+esm1

1:0.56.9.dfsg.1-1.2ubuntu2+esm1

ubuntu/libuser*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/libuser to a version that resolves this vulnerability.
Fixed in 1:0.56.9.dfsg.1-1.2ubuntu2+esm1

Event History

Aug 11, 2015

CVE Published

via OSV·02:59 PM

Data Sourced

via OSV·02:59 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who can exploit this issue?

A local user can exploit it through the chfn function as used by the userhelper program in the usermode package. Remote exploitation is not indicated by the available information.

What input is required to trigger the denial of service?

The attacker needs to place a newline character in the GECOS field. The incomplete blacklist permits this input and can result in corruption of /etc/passwd.

Which libuser versions are affected?

The issue affects libuser versions before 0.56.13-8 and versions before 0.60-7.

UBUNTU-CVE-2015-3245: Low severity ubuntu/libuser vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What input is required to trigger the denial of service?

Which libuser versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What input is required to trigger the denial of service?

Which libuser versions are affected?