RHSA-2015:1483High

Red Hat Security Advisory: libuser security update

Published
July 23, 2015
Last Modified
November 5, 2026

🔗 CVE IDs covered (2)

CVE-2015-3245 →CVE-2015-3246 →

📋 Description

CVE-2015-3245 — libuser: does not filter newline characters in the GECOS field CVE-2015-3246 — libuser: Security flaw in handling /etc/passwd file

🎯 Affected products72

  • Red Hat Enterprise Linux Client (v. 7)
  • Red Hat Enterprise Linux Client Optional (v. 7)
  • Red Hat Enterprise Linux ComputeNode (v. 7)
  • Red Hat Enterprise Linux ComputeNode Optional (v. 7)
  • Red Hat Enterprise Linux Server (v. 7)
  • Red Hat Enterprise Linux Server Optional (v. 7)
  • Red Hat Enterprise Linux Workstation (v. 7)
  • Red Hat Enterprise Linux Workstation Optional (v. 7)
  • libuser-0:0.60-7.ael7b_1.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7)
  • libuser-0:0.60-7.ael7b_1.src as a component of Red Hat Enterprise Linux Server (v. 7)
  • libuser-0:0.60-7.el7_1.i686 as a component of Red Hat Enterprise Linux Client (v. 7)
  • libuser-0:0.60-7.el7_1.i686 as a component of Red Hat Enterprise Linux ComputeNode (v. 7)
  • libuser-0:0.60-7.el7_1.i686 as a component of Red Hat Enterprise Linux Server (v. 7)
  • libuser-0:0.60-7.el7_1.i686 as a component of Red Hat Enterprise Linux Workstation (v. 7)
  • libuser-0:0.60-7.el7_1.ppc as a component of Red Hat Enterprise Linux Server (v. 7)
  • libuser-0:0.60-7.el7_1.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7)
  • libuser-0:0.60-7.el7_1.s390 as a component of Red Hat Enterprise Linux Server (v. 7)
  • libuser-0:0.60-7.el7_1.s390x as a component of Red Hat Enterprise Linux Server (v. 7)
  • libuser-0:0.60-7.el7_1.src as a component of Red Hat Enterprise Linux Client (v. 7)
  • libuser-0:0.60-7.el7_1.src as a component of Red Hat Enterprise Linux ComputeNode (v. 7)
  • libuser-0:0.60-7.el7_1.src as a component of Red Hat Enterprise Linux Server (v. 7)
  • libuser-0:0.60-7.el7_1.src as a component of Red Hat Enterprise Linux Workstation (v. 7)
  • libuser-0:0.60-7.el7_1.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)
  • libuser-0:0.60-7.el7_1.x86_64 as a component of Red Hat Enterprise Linux ComputeNode (v. 7)
  • libuser-0:0.60-7.el7_1.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)
  • libuser-0:0.60-7.el7_1.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)
  • libuser-debuginfo-0:0.60-7.ael7b_1.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7)
  • libuser-debuginfo-0:0.60-7.ael7b_1.ppc64le as a component of Red Hat Enterprise Linux Server Optional (v. 7)
  • libuser-debuginfo-0:0.60-7.el7_1.i686 as a component of Red Hat Enterprise Linux Client (v. 7)
  • libuser-debuginfo-0:0.60-7.el7_1.i686 as a component of Red Hat Enterprise Linux Client Optional (v. 7)
  • +42 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Add pam_warn and pam_deny rules to /etc/pam.d/chfn and /etc/pam.d/chsh to prevent non-root users from using this functionality. With these edits, the files should contain: #%PAM-1.0 auth sufficient pam_rootok.so auth required pam_warn.so auth required pam_deny.so auth include system-auth account include system-auth password include system-auth session include system-auth Afterwards, attempts by unprivileged users to use chfn and chsh (and the respective functionality in the userhelper program) will fail, and will be logged (by default in /var/log/secure). Workaround: Add pam_warn and pam_deny rules to /etc/pam.d/chfn and /etc/pam.d/chsh to prevent non-root users from using this functionality. With these edits, the files should contain: auth sufficient pam_rootok.so auth required pam_warn.so auth required pam_deny.so auth include system-auth account include system-auth password include system-auth session include system-auth After these changes, attempts by unprivileged users to use chfn and chsh (and the respective functionality in the userhelper program) will fail, and will be logged (by default in /var/log/secure).

🔗 References (5)