Scientific Linux Security Update : libuser on SL7.x x86_64

High Nessus Plugin ID 85004

Synopsis

The remote Scientific Linux host is missing one or more security updates.

Description

Two flaws were found in the way the libuser library handled the /etc/passwd file. A local attacker could use an application compiled against libuser (for example, userhelper) to manipulate the /etc/passwd file, which could result in a denial of service or possibly allow the attacker to escalate their privileges to root.
(CVE-2015-3245, CVE-2015-3246)

Solution

Update the affected packages.

See Also

http://www.nessus.org/u?55d151f7

Plugin Details

Severity: High

ID: 85004

File Name: sl_20150723_libuser_on_SL7_x.nasl

Version: 2.11

Type: local

Agent: unix

Published: 2015/07/27

Updated: 2018/12/28

Dependencies: 12634

Risk Information

Risk Factor: High

CVSS v2.0

Base Score: 7.2

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Information

CPE: x-cpe:/o:fermilab:scientific_linux

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/RedHat/release, Host/RedHat/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2015/07/23

Exploitable With

Core Impact

Metasploit (Libuser roothelper Privilege Escalation)

Reference Information

CVE: CVE-2015-3245, CVE-2015-3246

IAVA: 2015-A-0179