On this page (8 sections)
Ubuntu has published notice USN-8987-1 for two vulnerabilities in libuser, a library used to manage user and group accounts. Both flaws were first disclosed in 2015, and Red Hat shipped fixes for its platforms in July 2015. The Ubuntu notice describes them as ways for a local attacker to corrupt the passwd file and cause a denial of service, with a possible path to privilege escalation.
If you run Linux servers where other people or other applications have shell access (shared hosting, build servers, multi-user admin boxes), this is worth a quick check. It is a local issue: an attacker needs an account on the machine first.
At a glance
What the two flaws are
libuser implements a standard interface for managing user and group accounts, and includes sample tools modeled on the shadow-utils suite. Red Hat's advisory says two flaws were found in how it handled the /etc/passwd file, and that a local attacker could use an application built against libuser, for example userhelper, to manipulate that file. Red Hat credits Qualys with reporting both issues.
CVE-2015-3245: incomplete input filtering
The chfn function in libuser did not filter newline characters in the GECOS field (the free-text field holding a user's full name and contact details). Because /etc/passwd stores one account per line, an unfiltered newline lets a local user inject unexpected content and corrupt the file. The weakness class is improper input validation (CWE-20), per the GitHub advisory.
CVE-2015-3246: modifying /etc/passwd in place
libuser edited /etc/passwd directly. If an error occurs partway through, the file can be left in an inconsistent state. The GitHub advisory classes this as a time-of-check time-of-use race condition (CWE-367) and labels it High, and the CVE record provided carries a CVSS score of 7.4. The record also notes that it can be combined with CVE-2015-3245 to gain privileges.
Ubuntu's notice puts the combined risk this way: corrupting the passwd file leads to denial of service, and in-place modification could possibly allow privilege escalation. Red Hat's wording is that an attacker could possibly escalate to root. Neither source publishes a confirmed, reliable exploitation path in the text I reviewed, so treat escalation as a realistic possibility rather than a proven outcome on every system.
Is exploitation happening?
I could not confirm active exploitation from the sources provided. The GitHub advisory for CVE-2015-3246 lists a CISA Known Exploited Vulnerabilities catalog link and a Cisco Talos blog post among its references, and its EPSS score is 8.503% (95th percentile). A reference link alone does not prove that the CVE was exploited, and the research does not include the contents of those pages. Check the CISA catalog entry yourself before relying on either answer.
- CVSS score for CVE-2015-3246 (CVE record provided)
- 7.4
- EPSS score for CVE-2015-3246 (GitHub advisory)
- 8.503%
- EPSS score for CVE-2015-3245 (GitHub advisory)
- 5.391%
- Red Hat RHEL 6 and 7 errata issued
- 2015-07-23
Who is realistically exposed
- Servers with untrusted or semi-trusted local users: shared hosting, student or contractor shell access, CI runners, jump hosts.
- Systems where a web application compromise gives an attacker a low-privilege shell. A local escalation flaw can turn a contained incident into a full takeover.
- Red Hat Enterprise Linux 6 and 7 family systems where libuser is installed. Check whether long-lived or archived images ever received the 2015 errata.
- Ubuntu systems that have libuser installed. The research does not say which Ubuntu releases are affected or which package versions fix the issue, so open USN-8987-1 for the release-specific details.
Servers without libuser installed are not covered by this notice. Single-user machines with no untrusted local access have a much lower practical risk.
How to check your systems
First find out whether libuser is installed and which version you have. On Debian and Ubuntu, this read-only command lists matching installed packages and their versions. No output means no matching package is installed.
dpkg -l | grep -i libuserOn Red Hat family systems, this read-only query shows the installed libuser and usermode packages. Compare the libuser version to the fixed builds in the Red Hat advisories (for RHEL 6, libuser-0.56.13-8.el6_7; for RHEL 7, see RHSA-2015:1483).
rpm -q libuser usermodeThen look at the integrity of your account files. A corrupted /etc/passwd often shows up as lines with the wrong number of fields. Review the file by eye for lines or accounts you do not recognize, including any extra account with UID 0. The standard pwck utility also verifies the integrity of the passwd and shadow files; see its manual page (man pwck) for its options before running it.
cut -d: -f1,3,6 /etc/passwdWhat to do now
0 of 6 done
To update on Debian and Ubuntu, refresh package lists and upgrade installed packages. Read Ubuntu's notice for the exact package names and release-specific fixed versions, as they are not listed in the material I reviewed.
sudo apt update && sudo apt upgradeOn Red Hat family systems, update only the relevant packages.
sudo yum update libuser usermodeDetection and monitoring afterwards
Local privilege escalation is hard to see from outside, so rely on host-level signals. Watch for unexpected changes to /etc/passwd and /etc/shadow with file integrity monitoring, alert on new UID 0 accounts, and keep authentication logs. A sudden failure of logins or of tools that read the passwd file can also be a sign of corruption.
Since an attacker usually needs a foothold first, it also helps to watch the public side of your server. An outside-in security scan and certificate and header-change monitoring will not detect this flaw, but they can help you spot web-facing problems that often come before local escalation. For background, see our guide on what to do if a website is hacked.
Timeline
| Date | Event |
|---|---|
| 2015-07-23 | Red Hat issues RHSA-2015:1482 (RHEL 6) and RHSA-2015:1483 (RHEL 7), crediting Qualys with reporting the issues |
| 2015-08-11 | CVE-2015-3245 and CVE-2015-3246 published by NVD |
| 2026-11-03 | Ubuntu publishes USN-8987-1 |
Sources
This article is based on the public sources below. Details can change as vendors and researchers publish more; check the original advisories before acting on version numbers.