Debian DLA-468-1 : libuser security update
High Nessus Plugin ID 91108
SynopsisThe remote Debian host is missing a security update.
DescriptionTwo security vulnerabilities were discovered in libuser, a library that implements a standardized interface for manipulating and administering user and group accounts, that could lead to a denial of service or privilege escalation by local users.
CVE-2015-3245 Incomplete blacklist vulnerability in the chfn function in libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, allows local users to cause a denial of service (/etc/passwd corruption) via a newline character in the GECOS field.
CVE-2015-3246 libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, directly modifies /etc/passwd, which allows local users to cause a denial of service (inconsistent file state) by causing an error during the modification.
NOTE: this issue can be combined with CVE-2015-3245 to gain privileges.
In addition the usermode package, which depends on libuser, was rebuilt against the updated version.
For Debian 7 'Wheezy', these problems have been fixed in
libuser 1:0.56.9.dfsg.1-1.2+deb7u1 usermode 1.109-1+deb7u2
We recommend that you upgrade your libuser and usermode packages.
NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
SolutionUpgrade the affected packages.