RHSA-2015:1482High

Red Hat Security Advisory: libuser security update

Published
July 23, 2015
Last Modified
November 5, 2026

🔗 CVE IDs covered (2)

CVE-2015-3245 →CVE-2015-3246 →

📋 Description

CVE-2015-3245 — libuser: does not filter newline characters in the GECOS field CVE-2015-3246 — libuser: Security flaw in handling /etc/passwd file

🎯 Affected products69

  • Red Hat Enterprise Linux Desktop (v. 6)
  • Red Hat Enterprise Linux Desktop Optional (v. 6)
  • Red Hat Enterprise Linux HPC Node (v. 6)
  • Red Hat Enterprise Linux HPC Node Optional (v. 6)
  • Red Hat Enterprise Linux Server (v. 6)
  • Red Hat Enterprise Linux Server Optional (v. 6)
  • Red Hat Enterprise Linux Workstation (v. 6)
  • Red Hat Enterprise Linux Workstation Optional (v. 6)
  • libuser-0:0.56.13-8.el6_7.i686 as a component of Red Hat Enterprise Linux Desktop (v. 6)
  • libuser-0:0.56.13-8.el6_7.i686 as a component of Red Hat Enterprise Linux HPC Node (v. 6)
  • libuser-0:0.56.13-8.el6_7.i686 as a component of Red Hat Enterprise Linux Server (v. 6)
  • libuser-0:0.56.13-8.el6_7.i686 as a component of Red Hat Enterprise Linux Workstation (v. 6)
  • libuser-0:0.56.13-8.el6_7.ppc as a component of Red Hat Enterprise Linux Server (v. 6)
  • libuser-0:0.56.13-8.el6_7.ppc64 as a component of Red Hat Enterprise Linux Server (v. 6)
  • libuser-0:0.56.13-8.el6_7.s390 as a component of Red Hat Enterprise Linux Server (v. 6)
  • libuser-0:0.56.13-8.el6_7.s390x as a component of Red Hat Enterprise Linux Server (v. 6)
  • libuser-0:0.56.13-8.el6_7.src as a component of Red Hat Enterprise Linux Desktop (v. 6)
  • libuser-0:0.56.13-8.el6_7.src as a component of Red Hat Enterprise Linux HPC Node (v. 6)
  • libuser-0:0.56.13-8.el6_7.src as a component of Red Hat Enterprise Linux Server (v. 6)
  • libuser-0:0.56.13-8.el6_7.src as a component of Red Hat Enterprise Linux Workstation (v. 6)
  • libuser-0:0.56.13-8.el6_7.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 6)
  • libuser-0:0.56.13-8.el6_7.x86_64 as a component of Red Hat Enterprise Linux HPC Node (v. 6)
  • libuser-0:0.56.13-8.el6_7.x86_64 as a component of Red Hat Enterprise Linux Server (v. 6)
  • libuser-0:0.56.13-8.el6_7.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 6)
  • libuser-debuginfo-0:0.56.13-8.el6_7.i686 as a component of Red Hat Enterprise Linux Desktop (v. 6)
  • libuser-debuginfo-0:0.56.13-8.el6_7.i686 as a component of Red Hat Enterprise Linux Desktop Optional (v. 6)
  • libuser-debuginfo-0:0.56.13-8.el6_7.i686 as a component of Red Hat Enterprise Linux HPC Node (v. 6)
  • libuser-debuginfo-0:0.56.13-8.el6_7.i686 as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6)
  • libuser-debuginfo-0:0.56.13-8.el6_7.i686 as a component of Red Hat Enterprise Linux Server (v. 6)
  • libuser-debuginfo-0:0.56.13-8.el6_7.i686 as a component of Red Hat Enterprise Linux Server Optional (v. 6)
  • +39 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Add pam_warn and pam_deny rules to /etc/pam.d/chfn and /etc/pam.d/chsh to prevent non-root users from using this functionality. With these edits, the files should contain: #%PAM-1.0 auth sufficient pam_rootok.so auth required pam_warn.so auth required pam_deny.so auth include system-auth account include system-auth password include system-auth session include system-auth Afterwards, attempts by unprivileged users to use chfn and chsh (and the respective functionality in the userhelper program) will fail, and will be logged (by default in /var/log/secure). Workaround: Add pam_warn and pam_deny rules to /etc/pam.d/chfn and /etc/pam.d/chsh to prevent non-root users from using this functionality. With these edits, the files should contain: auth sufficient pam_rootok.so auth required pam_warn.so auth required pam_deny.so auth include system-auth account include system-auth password include system-auth session include system-auth After these changes, attempts by unprivileged users to use chfn and chsh (and the respective functionality in the userhelper program) will fail, and will be logged (by default in /var/log/secure).

🔗 References (5)