« Volver al listado

CVE-2015-3245

Estado: ModificadaBaja (2.1)—

Incomplete blacklist vulnerability in the chfn function in libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, allows local users to cause a denial of service (/etc/passwd corruption) via a newline character in the GECOS field.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Redhat — Libuser

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2015-3245",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 2.1,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:L/Au:N/C:N/I:N/A:P",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2015-08-11T14:59:05.570",
  "references": [
    {
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163044.html",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-July/162947.html",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://rhn.redhat.com/errata/RHSA-2015-1482.html",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://rhn.redhat.com/errata/RHSA-2015-1483.html",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/76021",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.securitytracker.com/id/1033040",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/articles/1537873",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://www.exploit-db.com/exploits/44633/",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://www.qualys.com/2015/07/23/cve-2015-3245-cve-2015-3246/cve-2015-3245-cve-2015-3246.txt",
      "tags": [
        "Exploit"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163044.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-July/162947.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://rhn.redhat.com/errata/RHSA-2015-1482.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://rhn.redhat.com/errata/RHSA-2015-1483.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/76021",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id/1033040",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://access.redhat.com/articles/1537873",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.exploit-db.com/exploits/44633/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.qualys.com/2015/07/23/cve-2015-3245-cve-2015-3246/cve-2015-3245-cve-2015-3246.txt",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Incomplete blacklist vulnerability in the chfn function in libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, allows local users to cause a denial of service (/etc/passwd corruption) via a newline character in the GECOS field."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de lista negra incompleta en la función chfn en libuser en versiones anteriores a 0.56.13-8 y 0.60 en versiones anteriores a 0.60-7, tal como se utiliza en el programa userhelp en el paquete usermode, permite a usuarios locales provocar una denegación de servicio (/etc/passwd corruption) a través de un caracter de nueva línea en el campo GECOS."
    }
  ],
  "lastModified": "2026-06-17T00:25:36.610",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:redhat:libuser:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6DE02055-ABFB-4A4A-81DF-C91E4371C5C4",
              "versionEndIncluding": "0.56.13-5"
            },
            {
              "criteria": "cpe:2.3:a:redhat:libuser:0.60-1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F65586F4-FA31-4F67-825E-1BDD1C904AE7"
            },
            {
              "criteria": "cpe:2.3:a:redhat:libuser:0.60-2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E1C1A46C-08EC-4997-8BF2-ACE6E313F644"
            },
            {
              "criteria": "cpe:2.3:a:redhat:libuser:0.60-3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6E93B3B2-A2D2-4BEB-BF4C-632A129B71CD"
            },
            {
              "criteria": "cpe:2.3:a:redhat:libuser:0.60-4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0F3BE074-6A6C-46A2-B9CC-39BA0EFCC4EB"
            },
            {
              "criteria": "cpe:2.3:a:redhat:libuser:0.60-5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DA7134C0-766F-47A8-ACFA-D457B801C534"
            },
            {
              "criteria": "cpe:2.3:a:redhat:libuser:0.60-6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7FE93709-708B-46A3-91A5-7AA9DC918CB9"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secalert@redhat.com"
}