Ubuntu notice covers two libuser flaws enabling local denial of service and possible privilege escalation
VULNERABILITYUbunturedteam/daily · 1 source
- Severity
- Medium
- Exploited
- Yes
- Sources
- 1
What happened
USN-8987-1 covers two local issues in libuser. CVE-2015-3245: the GECOS field is not properly validated when user information is changed, so a local attacker may corrupt /etc/passwd, causing denial of service. CVE-2015-3246: passwd is modified in place during user updates, which may leave the file inconsistent, causing denial of service or possibly local privilege escalation. The notice does not state affected or fixed package versions. Defenders should apply the libuser update from the Ubuntu notice and restrict local shell access where possible.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Install the libuser package update referenced in Ubuntu security notice USN-8987-1.
- Restrict local account access on multi-user systems until the update is applied.
Written by AI from the sources, checked against them
Vulnerabilities
Full story timeline · 2 updates
Who reported · 1 outlet
Ubuntu Security Notices
Who and what is in it
Products