libuser: direct /etc/passwd rewrites can corrupt the account database and chain to local root

CVE-2015-3246Kernel, userspace & hypervisorKnown exploitedcurated

Impact

libuser, as used by the setuid userhelper program in the usermode package, edits /etc/passwd in place. A local user who forces an error partway through the modification leaves the file in an inconsistent state, which on a shared login or head node can lock accounts - including operator accounts - out of the machine until the file is repaired by hand. On its own the record only claims denial of service, but it explicitly notes the issue can be combined with CVE-2015-3245 to gain privileges, and CISA lists it as exploited. Affected packages are RHEL 5/6/7-era and openSUSE 13.2; current images are not affected, but old base images and long-uptime login nodes are where these packages persist.

Who can reach it

Local user able to invoke userhelper - that is, anyone with an account on the host who can run chfn or chsh from the usermode package. Not remotely reachable.

What to do

Update libuser to 0.56.13-8 or 0.60-7 (or later) together with the usermode package, per RHSA-2015-1482 and RHSA-2015-1483. This is a package update only: no daemon restart and no reboot, since userhelper runs per invocation. If /etc/passwd has already been left inconsistent, repair it with pwck and restore from the shadow backup files before re-enabling logins.

References

https://nvd.nist.gov/vuln/detail/CVE-2015-3246 http://rhn.redhat.com/errata/RHSA-2015-1482.html http://rhn.redhat.com/errata/RHSA-2015-1483.html http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00000.html

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.