{"id":"CVE-2015-3246","kind":"vulnerability","aliases":["CVE-2015-3246"],"related":[],"title":"libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, directly…","description":"Red Hat libuser contains a race condition vulnerability that allows authenticated local users to corrupt the /etc/passwd file to cause a denial of service or privilege escalation.\n\nCISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","summary":"Race condition in libuser: it edits /etc/passwd in place instead of writing a temp copy and renaming it. A local user can run an app built on libuser (e.g. userhelper, chfn, chsh) to corrupt the file. The result is denial of service or root privilege escalation. Local access is required. CISA KEV lists it as exploited.","severity":"high","cvss":7.4,"epss":null,"exploited":true,"exploited_at":"2026-08-26T00:00:00+00:00","products":[{"name":"Red Hat Libuser","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"libuser","fixed":["0.56.13-8.el6_7","0.60-7.el7_1"],"affected":"RHEL 5 (all); RHEL 6 < 0.56.13-8.el6_7; RHEL 7 < 0.60-7.el7_1","ecosystem":"rpm"},{"name":"redhat enterprise linux","fixed":[],"affected":"= 5.0","ecosystem":"vendor"},{"name":"redhat enterprise linux","fixed":[],"affected":"= 6.0","ecosystem":"vendor"},{"name":"redhat enterprise linux","fixed":[],"affected":"= 7.0","ecosystem":"vendor"},{"name":"opensuse","fixed":[],"affected":"= 13.2","ecosystem":"vendor"},{"name":"libuser project libuser","fixed":["0.56.13-8"],"affected":"< 0.56.13-8","ecosystem":"vendor"},{"name":"libuser project libuser","fixed":["0.60-7"],"affected":">= 0.60, < 0.60-7","ecosystem":"vendor"}],"ecosystems":["rpm","vendor"],"tags":["exploited","infrastructure","libuser","linux","local-privilege-escalation","red-hat","rhel","self-hosted"],"not_affected_if":["managed-hosting","no-local-user-access","no-local-users"],"how_to_check":"On RHEL/CentOS/Oracle Linux run: rpm -q libuser. Vulnerable if older than 0.56.13-8.el6_7 (RHEL6) or 0.60-7.el7_1 (RHEL7). All RHEL5 libuser versions are affected.","fix":"RHEL6: yum update libuser to 0.56.13-8.el6_7 or later (RHSA-2015:1482). RHEL7: update to 0.60-7.el7_1 or later (RHSA-2015:1483). RHEL5: no fix planned; as a mitigation, add pam_rootok / pam_warn / pam_deny rules to /etc/pam.d/chfn and /etc/pam.d/chsh so unprivileged users cannot use them.","status":"open","published_at":"2015-08-11T14:59:07+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:31:48+00:00","updated_at":"2026-10-23T23:44:52+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-10-23T20:31:48Z","model":"claude-haiku-5-5","output":{"fix":"unknown","summary":"Red Hat libuser has a race condition that lets a logged-in local user corrupt /etc/passwd. An attacker gets denial of service or privilege escalation to root on the host.","category":"infrastructure","who_cares":["linux","red-hat","self-hosted"],"confidence":0.55,"analyst_note":"Sources do not list affected or fixed libuser versions or a package name to check; find the Red Hat advisory for CVE-2015-3246 and the fixed libuser package version.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-local-user-access","managed-hosting"],"severity_if_unknown":"high"},"cost_usd":0.000338,"input_tokens":2197,"output_tokens":237,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Sources do not list affected or fixed libuser versions or a package name to check; find the Red Hat advisory for CVE-2015-3246 and the fixed libuser package version.","search":"'-04':162C,188C,219C '-2015':22A,25A '-3246':23A,26A '-7':9A '-8':4A '/etc/passwd':68B,134C '0.56.13':3A '0.60':6A,8A '26':161C,187C,218C 'access':109B 'accord':151C 'action':147C 'adher':215C 'allow':127C 'app':86B 'appli':148C 'applic':185C 'asset':209C 'authent':128C 'base':166C 'bod':160C,186C,217C 'built':87B 'caus':137C 'chfn':92B 'chsh':93B 'cisa':112B,145C,158C,175C 'cloud':191C 'complianc':156C 'condit':63B,124C 'contain':121C 'copi':76B 'corrupt':95B,132C 'cve':21A,24A 'denial':101B,139C 'direct':20A 'discontinu':194C 'e.g':90B 'edit':67B 'ensur':155C,214C 'enterprise':32A,35A,38A 'escal':54B,107B,144C 'evalu':207C 'exploit':47B,117B 'exposur':212C 'file':97B,135C 'follow':184C 'forens':177C 'guidanc':173C,189C 'guidelin':221C 'hat':28A,57B,119C 'host':61B 'infrastructur':48B 'instead':71B 'instruct':154C 'internet':211C 'kev':113B 'libus':1A,49B,65B,89B,120C 'libuser':29A,30A,41A,43A,44A,46A 'linux':33A,36A,39A,50B 'list':114B 'local':52B,81B,108B,129C 'local-privilege-escal':51B 'mitig':149C,200C 'note':172C,183C 'opensuse':40A 'packag':19A 'patch':220C 'place':70B 'priorit':163C 'privileg':53B,106B,143C 'product':198C 'program':15A 'project':42A,45A 'race':62B,123C 'red':27A,56B,118C 'red-hat':55B 'redhat':31A,34A,37A 'renam':78B 'requir':111B,146C,179C 'respons':205C 'result':99B 'rhel':58B 'risk':168C 'root':105B 'run':84B 'secur':164C 'see':169C,180C 'self':60B 'self-host':59B 'servic':103B,141C,192C 'stakehold':203C 'temp':75B 'triag':178C 'unavail':202C 'updat':165C 'url':170C,181C 'use':11A,195C 'user':82B,130C 'userhelp':14A,91B 'usermod':18A 'vendor':153C 'vulner':125C 'write':73B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2015-08-11T14:59:07+00:00","kev":{"dateAdded":"2026-08-26","dueDate":"2026-09-09","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2015-3246","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2015-3246","severity":null,"published_at":"2026-08-26T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T17:39:54+00:00","note":null},{"source":"analyst","external_id":"CVE-2015-3246:127","url":null,"severity":null,"published_at":"2026-10-23T21:40:21+00:00","modified_at":"2026-10-23T21:40:21+00:00","first_seen_at":"2026-10-23T21:40:21+00:00","fetched_at":"2026-10-23T21:40:21+00:00","note":"Read Red Hat article 1537873, RHSA-2015:1482 (via LWN), ELSA-2015-1483 mirror, and Red Hat CVE page. Fixed: RHEL6 libuser-0.56.13-8.el6_7, RHEL7 libuser-0.60-7.el7_1 (RHSA-2015:1483; version read on the Oracle mirror). RHEL5 is affected and will not be fixed. KEV lists it as exploited. I did not look for a public PoC or social discussion; the issue is from 2015 and was reported by Qualys."},{"source":"nvd","external_id":"CVE-2015-3246","url":"https://nvd.nist.gov/vuln/detail/CVE-2015-3246","severity":null,"published_at":"2015-08-11T14:59:07+00:00","modified_at":"2026-10-02T11:33:29+00:00","first_seen_at":"2026-10-23T23:44:52+00:00","fetched_at":"2026-10-23T23:44:52+00:00","note":null}],"documents":[{"id":1179,"url":"https://access.redhat.com/articles/1537873","title":"libuser vulnerabilities (CVE-2015-3245 and CVE-2015-3246) - Red Hat","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1181,"url":"https://lwn.net/Articles/652340/","title":"RHSA-2015:1482 libuser (RHEL 6)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":1182,"url":"https://linux.oracle.com/errata/ELSA-2015-1483.html","title":"ELSA-2015-1483 libuser 0.60-7.el7_1 (mirrors RHSA-2015:1483)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":1184,"url":"https://access.redhat.com/security/cve/cve-2015-3246","title":"CVE-2015-3246 Red Hat CVE page (RHEL5 statement, mitigation)","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"mitigation","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}