vendor:
libuser
by:
Qualys, h00die
7.2
CVSS
HIGH
Privilege Escalation
264
CWE
Product Name: libuser
Affected Version From: 0.56.13-4.el6
Affected Version To: 0.60-6.fc22
Patch Exists: YES
Related CWE: CVE-2015-3245
CPE: a:redhat:libuser:0.56.13-4.el6
Metasploit:
https://www.rapid7.com/db/vulnerabilities/debian-cve-2015-3246/, https://www.rapid7.com/db/vulnerabilities/f5-big-ip-cve-2015-3246/, https://www.rapid7.com/db/vulnerabilities/centos_linux-cve-2015-3245/, https://www.rapid7.com/db/vulnerabilities/centos_linux-cve-2015-3246/, https://www.rapid7.com/db/vulnerabilities/linuxrpm-RHSA-2015-1483/, https://www.rapid7.com/db/vulnerabilities/debian-cve-2015-3245/, https://www.rapid7.com/db/vulnerabilities/suse-cve-2015-3246/, https://www.rapid7.com/db/vulnerabilities/linuxrpm-ELSA-2015-1482/, https://www.rapid7.com/db/vulnerabilities/amazon-linux-ami-alas-2015-572/, https://www.rapid7.com/db/vulnerabilities/linuxrpm-ELSA-2015-1483/, https://www.rapid7.com/db/vulnerabilities/linuxrpm-RHSA-2015-1482/
Other Scripts:
N/A
Platforms Tested: CentOS 6.0 (x86_64), CentOS 6.5 (x86_64), CentOS 7.1-1503 (x86_64), Fedora 13 (i686), Fedora Desktop 19 (x86_64), Fedora Desktop 20 (x86_64), Fedora Desktop 21 (x86_64), Fedora Desktop 22 (x86_64), Red Hat 6.6 (x86_64), Red Hat 7.0 (x86_64)
2015
Libuser roothelper Privilege Escalation
This module attempts to gain root privileges on Red Hat based Linux systems, including RHEL, Fedora and CentOS, by exploiting a newline injection vulnerability in libuser and userhelper versions prior to 0.56.13-8 and version 0.60 before 0.60-7. This module makes use of the roothelper.c exploit from Qualys to insert a new user with UID=0 in /etc/passwd.
Mitigation:
Upgrade to libuser version 0.56.13-8 or 0.60-7 or later.
