Vulnpedia
← All CVEs

CVE-2015-3245

LOW 2.1 PoC CATALOGUED ALL-YEARS

Published 2015-08-11 · Last modified 2024-08-06 · redhat · NVD: Modified

Incomplete blacklist vulnerability in the chfn function in libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, allows local users to cause a denial of service (/etc/passwd corruption) via a newline character in the GECOS field.

PUBLIC RESOURCES

A public PoC or exploit resource is catalogued. Review the linked source and affected versions below.

Exploitation likelihood

5.4%chance of exploitation in 30 days · 93rd percentile

○ In CISA KEV● Catalogued PoC

Impact if exploited

2.1CVSS 2.0 · LOW · NVD

  • ConfidentialityNone
  • IntegrityNone

What an attacker needs

  • ✓Complexity: No special conditions — reliably repeatable

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

Public PoC or exploit resources are catalogued below.

Listed by the named source; Vulnpedia has not tested these resources.

PoC data: JSON

Resource commands

searchsploit --cve CVE-2015-3245 && searchsploit -m 37706Fetch the ExploitDB PoC locally; review the code before running it.
searchsploit --cve CVE-2015-3245 && searchsploit -m 44633Fetch the ExploitDB PoC locally; review the code before running it.
curl -s https://vulnpedia.com/cve/CVE-2015-3245/poc.jsonMachine-readable PoC index for this CVE (for automation).

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked weekly for the full archive, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Data snapshot:

Affected

Vendors Redhat

Products Libuser

Weakness (CWE)

  • CWE-20: Improper input validation

CVSS vector

AV:L/AC:L/Au:N/C:N/I:N/A:P

References and research data (JSON)

Vendor product assessments

Showing 32 of 371 vendor product statements; 339 omitted. Read the full vendor advisory.

  • libuser-0:0.56.13-8.el6_7.i686 as a component of Red Hat Enterprise Linux Desktop (v. 6) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_7?arch=i686

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Add pam_warn and pam_deny rules to /etc/pam.d/chfn and /etc/pam.d/chsh to prevent non-root users from using this functionality. With these edits, the files should contain: #%PAM-1.0 auth sufficient pam_rootok.so auth required pam_warn.so auth required pam_deny.so auth include system-auth account include system-auth password include system-auth session include system-auth Afterwards, attempts by unprivileged users to use chfn and chsh (and the respective functionality in the userhelper program) will fail, and will be logged (by default in /var/log/secure).
    Red Hat · CVE-2015-3245 · Updated 2025-11-21T12:16:37+00:00
  • libuser-debuginfo-0:0.56.13-8.el6_7.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 6) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_7?arch=x86_64

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Add pam_warn and pam_deny rules to /etc/pam.d/chfn and /etc/pam.d/chsh to prevent non-root users from using this functionality. With these edits, the files should contain: #%PAM-1.0 auth sufficient pam_rootok.so auth required pam_warn.so auth required pam_deny.so auth include system-auth account include system-auth password include system-auth session include system-auth Afterwards, attempts by unprivileged users to use chfn and chsh (and the respective functionality in the userhelper program) will fail, and will be logged (by default in /var/log/secure).
    Red Hat · CVE-2015-3245 · Updated 2025-11-21T12:16:37+00:00
  • libuser-0:0.56.13-8.el6_7.ppc64 as a component of Red Hat Enterprise Linux Desktop Optional (v. 6) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_7?arch=ppc64

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Add pam_warn and pam_deny rules to /etc/pam.d/chfn and /etc/pam.d/chsh to prevent non-root users from using this functionality. With these edits, the files should contain: #%PAM-1.0 auth sufficient pam_rootok.so auth required pam_warn.so auth required pam_deny.so auth include system-auth account include system-auth password include system-auth session include system-auth Afterwards, attempts by unprivileged users to use chfn and chsh (and the respective functionality in the userhelper program) will fail, and will be logged (by default in /var/log/secure).
    Red Hat · CVE-2015-3245 · Updated 2025-11-21T12:16:37+00:00
  • libuser-devel-0:0.56.13-8.el6_7.ppc as a component of Red Hat Enterprise Linux Desktop Optional (v. 6) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_7?arch=ppc

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Add pam_warn and pam_deny rules to /etc/pam.d/chfn and /etc/pam.d/chsh to prevent non-root users from using this functionality. With these edits, the files should contain: #%PAM-1.0 auth sufficient pam_rootok.so auth required pam_warn.so auth required pam_deny.so auth include system-auth account include system-auth password include system-auth session include system-auth Afterwards, attempts by unprivileged users to use chfn and chsh (and the respective functionality in the userhelper program) will fail, and will be logged (by default in /var/log/secure).
    Red Hat · CVE-2015-3245 · Updated 2025-11-21T12:16:37+00:00
  • libuser-0:0.56.13-8.el6_7.s390 as a component of Red Hat Enterprise Linux HPC Node (v. 6) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_7?arch=s390

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Add pam_warn and pam_deny rules to /etc/pam.d/chfn and /etc/pam.d/chsh to prevent non-root users from using this functionality. With these edits, the files should contain: #%PAM-1.0 auth sufficient pam_rootok.so auth required pam_warn.so auth required pam_deny.so auth include system-auth account include system-auth password include system-auth session include system-auth Afterwards, attempts by unprivileged users to use chfn and chsh (and the respective functionality in the userhelper program) will fail, and will be logged (by default in /var/log/secure).
    Red Hat · CVE-2015-3245 · Updated 2025-11-21T12:16:37+00:00
  • libuser-devel-0:0.56.13-8.el6_7.s390 as a component of Red Hat Enterprise Linux HPC Node (v. 6) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_7?arch=s390

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Add pam_warn and pam_deny rules to /etc/pam.d/chfn and /etc/pam.d/chsh to prevent non-root users from using this functionality. With these edits, the files should contain: #%PAM-1.0 auth sufficient pam_rootok.so auth required pam_warn.so auth required pam_deny.so auth include system-auth account include system-auth password include system-auth session include system-auth Afterwards, attempts by unprivileged users to use chfn and chsh (and the respective functionality in the userhelper program) will fail, and will be logged (by default in /var/log/secure).
    Red Hat · CVE-2015-3245 · Updated 2025-11-21T12:16:37+00:00
  • libuser-0:0.56.13-8.el6_7.src as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_7?arch=src

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Add pam_warn and pam_deny rules to /etc/pam.d/chfn and /etc/pam.d/chsh to prevent non-root users from using this functionality. With these edits, the files should contain: #%PAM-1.0 auth sufficient pam_rootok.so auth required pam_warn.so auth required pam_deny.so auth include system-auth account include system-auth password include system-auth session include system-auth Afterwards, attempts by unprivileged users to use chfn and chsh (and the respective functionality in the userhelper program) will fail, and will be logged (by default in /var/log/secure).
    Red Hat · CVE-2015-3245 · Updated 2025-11-21T12:16:37+00:00
  • libuser-devel-0:0.56.13-8.el6_7.s390x as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_7?arch=s390x

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Add pam_warn and pam_deny rules to /etc/pam.d/chfn and /etc/pam.d/chsh to prevent non-root users from using this functionality. With these edits, the files should contain: #%PAM-1.0 auth sufficient pam_rootok.so auth required pam_warn.so auth required pam_deny.so auth include system-auth account include system-auth password include system-auth session include system-auth Afterwards, attempts by unprivileged users to use chfn and chsh (and the respective functionality in the userhelper program) will fail, and will be logged (by default in /var/log/secure).
    Red Hat · CVE-2015-3245 · Updated 2025-11-21T12:16:37+00:00
  • libuser-0:0.56.13-8.el6_7.x86_64 as a component of Red Hat Enterprise Linux Server (v. 6) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_7?arch=x86_64

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Add pam_warn and pam_deny rules to /etc/pam.d/chfn and /etc/pam.d/chsh to prevent non-root users from using this functionality. With these edits, the files should contain: #%PAM-1.0 auth sufficient pam_rootok.so auth required pam_warn.so auth required pam_deny.so auth include system-auth account include system-auth password include system-auth session include system-auth Afterwards, attempts by unprivileged users to use chfn and chsh (and the respective functionality in the userhelper program) will fail, and will be logged (by default in /var/log/secure).
    Red Hat · CVE-2015-3245 · Updated 2025-11-21T12:16:37+00:00
  • libuser-python-0:0.56.13-8.el6_7.i686 as a component of Red Hat Enterprise Linux Server (v. 6) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_7?arch=i686

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Add pam_warn and pam_deny rules to /etc/pam.d/chfn and /etc/pam.d/chsh to prevent non-root users from using this functionality. With these edits, the files should contain: #%PAM-1.0 auth sufficient pam_rootok.so auth required pam_warn.so auth required pam_deny.so auth include system-auth account include system-auth password include system-auth session include system-auth Afterwards, attempts by unprivileged users to use chfn and chsh (and the respective functionality in the userhelper program) will fail, and will be logged (by default in /var/log/secure).
    Red Hat · CVE-2015-3245 · Updated 2025-11-21T12:16:37+00:00
  • libuser-debuginfo-0:0.56.13-8.el6_7.ppc as a component of Red Hat Enterprise Linux Server Optional (v. 6) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_7?arch=ppc

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Add pam_warn and pam_deny rules to /etc/pam.d/chfn and /etc/pam.d/chsh to prevent non-root users from using this functionality. With these edits, the files should contain: #%PAM-1.0 auth sufficient pam_rootok.so auth required pam_warn.so auth required pam_deny.so auth include system-auth account include system-auth password include system-auth session include system-auth Afterwards, attempts by unprivileged users to use chfn and chsh (and the respective functionality in the userhelper program) will fail, and will be logged (by default in /var/log/secure).
    Red Hat · CVE-2015-3245 · Updated 2025-11-21T12:16:37+00:00
  • libuser-python-0:0.56.13-8.el6_7.ppc64 as a component of Red Hat Enterprise Linux Server Optional (v. 6) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_7?arch=ppc64

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Add pam_warn and pam_deny rules to /etc/pam.d/chfn and /etc/pam.d/chsh to prevent non-root users from using this functionality. With these edits, the files should contain: #%PAM-1.0 auth sufficient pam_rootok.so auth required pam_warn.so auth required pam_deny.so auth include system-auth account include system-auth password include system-auth session include system-auth Afterwards, attempts by unprivileged users to use chfn and chsh (and the respective functionality in the userhelper program) will fail, and will be logged (by default in /var/log/secure).
    Red Hat · CVE-2015-3245 · Updated 2025-11-21T12:16:37+00:00
  • libuser-debuginfo-0:0.56.13-8.el6_7.s390 as a component of Red Hat Enterprise Linux Workstation (v. 6) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_7?arch=s390

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Add pam_warn and pam_deny rules to /etc/pam.d/chfn and /etc/pam.d/chsh to prevent non-root users from using this functionality. With these edits, the files should contain: #%PAM-1.0 auth sufficient pam_rootok.so auth required pam_warn.so auth required pam_deny.so auth include system-auth account include system-auth password include system-auth session include system-auth Afterwards, attempts by unprivileged users to use chfn and chsh (and the respective functionality in the userhelper program) will fail, and will be logged (by default in /var/log/secure).
    Red Hat · CVE-2015-3245 · Updated 2025-11-21T12:16:37+00:00
  • libuser-python-0:0.56.13-8.el6_7.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 6) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_7?arch=x86_64

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Add pam_warn and pam_deny rules to /etc/pam.d/chfn and /etc/pam.d/chsh to prevent non-root users from using this functionality. With these edits, the files should contain: #%PAM-1.0 auth sufficient pam_rootok.so auth required pam_warn.so auth required pam_deny.so auth include system-auth account include system-auth password include system-auth session include system-auth Afterwards, attempts by unprivileged users to use chfn and chsh (and the respective functionality in the userhelper program) will fail, and will be logged (by default in /var/log/secure).
    Red Hat · CVE-2015-3245 · Updated 2025-11-21T12:16:37+00:00
  • libuser-debuginfo-0:0.56.13-8.el6_7.s390x as a component of Red Hat Enterprise Linux Workstation Optional (v. 6) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_7?arch=s390x

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Add pam_warn and pam_deny rules to /etc/pam.d/chfn and /etc/pam.d/chsh to prevent non-root users from using this functionality. With these edits, the files should contain: #%PAM-1.0 auth sufficient pam_rootok.so auth required pam_warn.so auth required pam_deny.so auth include system-auth account include system-auth password include system-auth session include system-auth Afterwards, attempts by unprivileged users to use chfn and chsh (and the respective functionality in the userhelper program) will fail, and will be logged (by default in /var/log/secure).
    Red Hat · CVE-2015-3245 · Updated 2025-11-21T12:16:37+00:00
  • libuser-0:0.60-7.el7_1.i686 as a component of Red Hat Enterprise Linux Client (v. 7) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_1?arch=i686

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Add pam_warn and pam_deny rules to /etc/pam.d/chfn and /etc/pam.d/chsh to prevent non-root users from using this functionality. With these edits, the files should contain: #%PAM-1.0 auth sufficient pam_rootok.so auth required pam_warn.so auth required pam_deny.so auth include system-auth account include system-auth password include system-auth session include system-auth Afterwards, attempts by unprivileged users to use chfn and chsh (and the respective functionality in the userhelper program) will fail, and will be logged (by default in /var/log/secure).
    Red Hat · CVE-2015-3245 · Updated 2025-11-21T12:16:37+00:00
  • libuser-devel-0:0.60-7.el7_1.i686 as a component of Red Hat Enterprise Linux Client (v. 7) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_1?arch=i686

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Add pam_warn and pam_deny rules to /etc/pam.d/chfn and /etc/pam.d/chsh to prevent non-root users from using this functionality. With these edits, the files should contain: #%PAM-1.0 auth sufficient pam_rootok.so auth required pam_warn.so auth required pam_deny.so auth include system-auth account include system-auth password include system-auth session include system-auth Afterwards, attempts by unprivileged users to use chfn and chsh (and the respective functionality in the userhelper program) will fail, and will be logged (by default in /var/log/secure).
    Red Hat · CVE-2015-3245 · Updated 2025-11-21T12:16:37+00:00
  • libuser-0:0.60-7.el7_1.s390 as a component of Red Hat Enterprise Linux Client Optional (v. 7) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_1?arch=s390

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Add pam_warn and pam_deny rules to /etc/pam.d/chfn and /etc/pam.d/chsh to prevent non-root users from using this functionality. With these edits, the files should contain: #%PAM-1.0 auth sufficient pam_rootok.so auth required pam_warn.so auth required pam_deny.so auth include system-auth account include system-auth password include system-auth session include system-auth Afterwards, attempts by unprivileged users to use chfn and chsh (and the respective functionality in the userhelper program) will fail, and will be logged (by default in /var/log/secure).
    Red Hat · CVE-2015-3245 · Updated 2025-11-21T12:16:37+00:00
  • libuser-devel-0:0.60-7.el7_1.ppc64 as a component of Red Hat Enterprise Linux Client Optional (v. 7) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_1?arch=ppc64

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Add pam_warn and pam_deny rules to /etc/pam.d/chfn and /etc/pam.d/chsh to prevent non-root users from using this functionality. With these edits, the files should contain: #%PAM-1.0 auth sufficient pam_rootok.so auth required pam_warn.so auth required pam_deny.so auth include system-auth account include system-auth password include system-auth session include system-auth Afterwards, attempts by unprivileged users to use chfn and chsh (and the respective functionality in the userhelper program) will fail, and will be logged (by default in /var/log/secure).
    Red Hat · CVE-2015-3245 · Updated 2025-11-21T12:16:37+00:00
  • libuser-0:0.60-7.el7_1.x86_64 as a component of Red Hat Enterprise Linux ComputeNode (v. 7) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_1?arch=x86_64

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Add pam_warn and pam_deny rules to /etc/pam.d/chfn and /etc/pam.d/chsh to prevent non-root users from using this functionality. With these edits, the files should contain: #%PAM-1.0 auth sufficient pam_rootok.so auth required pam_warn.so auth required pam_deny.so auth include system-auth account include system-auth password include system-auth session include system-auth Afterwards, attempts by unprivileged users to use chfn and chsh (and the respective functionality in the userhelper program) will fail, and will be logged (by default in /var/log/secure).
    Red Hat · CVE-2015-3245 · Updated 2025-11-21T12:16:37+00:00
  • libuser-devel-0:0.60-7.el7_1.x86_64 as a component of Red Hat Enterprise Linux ComputeNode (v. 7) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_1?arch=x86_64

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Add pam_warn and pam_deny rules to /etc/pam.d/chfn and /etc/pam.d/chsh to prevent non-root users from using this functionality. With these edits, the files should contain: #%PAM-1.0 auth sufficient pam_rootok.so auth required pam_warn.so auth required pam_deny.so auth include system-auth account include system-auth password include system-auth session include system-auth Afterwards, attempts by unprivileged users to use chfn and chsh (and the respective functionality in the userhelper program) will fail, and will be logged (by default in /var/log/secure).
    Red Hat · CVE-2015-3245 · Updated 2025-11-21T12:16:37+00:00
  • libuser-debuginfo-0:0.60-7.el7_1.ppc as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_1?arch=ppc

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Add pam_warn and pam_deny rules to /etc/pam.d/chfn and /etc/pam.d/chsh to prevent non-root users from using this functionality. With these edits, the files should contain: #%PAM-1.0 auth sufficient pam_rootok.so auth required pam_warn.so auth required pam_deny.so auth include system-auth account include system-auth password include system-auth session include system-auth Afterwards, attempts by unprivileged users to use chfn and chsh (and the respective functionality in the userhelper program) will fail, and will be logged (by default in /var/log/secure).
    Red Hat · CVE-2015-3245 · Updated 2025-11-21T12:16:37+00:00
  • libuser-python-0:0.60-7.el7_1.x86_64 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_1?arch=x86_64

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Add pam_warn and pam_deny rules to /etc/pam.d/chfn and /etc/pam.d/chsh to prevent non-root users from using this functionality. With these edits, the files should contain: #%PAM-1.0 auth sufficient pam_rootok.so auth required pam_warn.so auth required pam_deny.so auth include system-auth account include system-auth password include system-auth session include system-auth Afterwards, attempts by unprivileged users to use chfn and chsh (and the respective functionality in the userhelper program) will fail, and will be logged (by default in /var/log/secure).
    Red Hat · CVE-2015-3245 · Updated 2025-11-21T12:16:37+00:00
  • libuser-debuginfo-0:0.60-7.el7_1.s390x as a component of Red Hat Enterprise Linux Server (v. 7) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_1?arch=s390x

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Add pam_warn and pam_deny rules to /etc/pam.d/chfn and /etc/pam.d/chsh to prevent non-root users from using this functionality. With these edits, the files should contain: #%PAM-1.0 auth sufficient pam_rootok.so auth required pam_warn.so auth required pam_deny.so auth include system-auth account include system-auth password include system-auth session include system-auth Afterwards, attempts by unprivileged users to use chfn and chsh (and the respective functionality in the userhelper program) will fail, and will be logged (by default in /var/log/secure).
    Red Hat · CVE-2015-3245 · Updated 2025-11-21T12:16:37+00:00
  • libuser-0:0.60-7.ael7b_1.src as a component of Red Hat Enterprise Linux Server (v. 7) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_1?arch=src

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Add pam_warn and pam_deny rules to /etc/pam.d/chfn and /etc/pam.d/chsh to prevent non-root users from using this functionality. With these edits, the files should contain: #%PAM-1.0 auth sufficient pam_rootok.so auth required pam_warn.so auth required pam_deny.so auth include system-auth account include system-auth password include system-auth session include system-auth Afterwards, attempts by unprivileged users to use chfn and chsh (and the respective functionality in the userhelper program) will fail, and will be logged (by default in /var/log/secure).
    Red Hat · CVE-2015-3245 · Updated 2025-11-21T12:16:37+00:00
  • libuser-debuginfo-0:0.60-7.el7_1.ppc64 as a component of Red Hat Enterprise Linux Server Optional (v. 7) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_1?arch=ppc64

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Add pam_warn and pam_deny rules to /etc/pam.d/chfn and /etc/pam.d/chsh to prevent non-root users from using this functionality. With these edits, the files should contain: #%PAM-1.0 auth sufficient pam_rootok.so auth required pam_warn.so auth required pam_deny.so auth include system-auth account include system-auth password include system-auth session include system-auth Afterwards, attempts by unprivileged users to use chfn and chsh (and the respective functionality in the userhelper program) will fail, and will be logged (by default in /var/log/secure).
    Red Hat · CVE-2015-3245 · Updated 2025-11-21T12:16:37+00:00
  • libuser-python-0:0.60-7.el7_1.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 7) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_1?arch=x86_64

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Add pam_warn and pam_deny rules to /etc/pam.d/chfn and /etc/pam.d/chsh to prevent non-root users from using this functionality. With these edits, the files should contain: #%PAM-1.0 auth sufficient pam_rootok.so auth required pam_warn.so auth required pam_deny.so auth include system-auth account include system-auth password include system-auth session include system-auth Afterwards, attempts by unprivileged users to use chfn and chsh (and the respective functionality in the userhelper program) will fail, and will be logged (by default in /var/log/secure).
    Red Hat · CVE-2015-3245 · Updated 2025-11-21T12:16:37+00:00
  • libuser-0:0.60-7.el7_1.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_1?arch=x86_64

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Add pam_warn and pam_deny rules to /etc/pam.d/chfn and /etc/pam.d/chsh to prevent non-root users from using this functionality. With these edits, the files should contain: #%PAM-1.0 auth sufficient pam_rootok.so auth required pam_warn.so auth required pam_deny.so auth include system-auth account include system-auth password include system-auth session include system-auth Afterwards, attempts by unprivileged users to use chfn and chsh (and the respective functionality in the userhelper program) will fail, and will be logged (by default in /var/log/secure).
    Red Hat · CVE-2015-3245 · Updated 2025-11-21T12:16:37+00:00
  • libuser-devel-0:0.60-7.el7_1.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_1?arch=x86_64

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Add pam_warn and pam_deny rules to /etc/pam.d/chfn and /etc/pam.d/chsh to prevent non-root users from using this functionality. With these edits, the files should contain: #%PAM-1.0 auth sufficient pam_rootok.so auth required pam_warn.so auth required pam_deny.so auth include system-auth account include system-auth password include system-auth session include system-auth Afterwards, attempts by unprivileged users to use chfn and chsh (and the respective functionality in the userhelper program) will fail, and will be logged (by default in /var/log/secure).
    Red Hat · CVE-2015-3245 · Updated 2025-11-21T12:16:37+00:00
  • libuser-debuginfo-0:0.60-7.el7_1.ppc64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_1?arch=ppc64

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Add pam_warn and pam_deny rules to /etc/pam.d/chfn and /etc/pam.d/chsh to prevent non-root users from using this functionality. With these edits, the files should contain: #%PAM-1.0 auth sufficient pam_rootok.so auth required pam_warn.so auth required pam_deny.so auth include system-auth account include system-auth password include system-auth session include system-auth Afterwards, attempts by unprivileged users to use chfn and chsh (and the respective functionality in the userhelper program) will fail, and will be logged (by default in /var/log/secure).
    Red Hat · CVE-2015-3245 · Updated 2025-11-21T12:16:37+00:00
  • libuser-python-0:0.60-7.el7_1.x86_64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_1?arch=x86_64

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Add pam_warn and pam_deny rules to /etc/pam.d/chfn and /etc/pam.d/chsh to prevent non-root users from using this functionality. With these edits, the files should contain: #%PAM-1.0 auth sufficient pam_rootok.so auth required pam_warn.so auth required pam_deny.so auth include system-auth account include system-auth password include system-auth session include system-auth Afterwards, attempts by unprivileged users to use chfn and chsh (and the respective functionality in the userhelper program) will fail, and will be logged (by default in /var/log/secure).
    Red Hat · CVE-2015-3245 · Updated 2025-11-21T12:16:37+00:00
  • libuser as a component of Red Hat Enterprise Linux 5 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/libuser?arch=src

    • workaround: Add pam_warn and pam_deny rules to /etc/pam.d/chfn and /etc/pam.d/chsh to prevent non-root users from using this functionality. With these edits, the files should contain: #%PAM-1.0 auth sufficient pam_rootok.so auth required pam_warn.so auth required pam_deny.so auth include system-auth account include system-auth password include system-auth session include system-auth Afterwards, attempts by unprivileged users to use chfn and chsh (and the respective functionality in the userhelper program) will fail, and will be logged (by default in /var/log/secure).
    • no fix planned: Will not fix
    Red Hat · CVE-2015-3245 · Updated 2025-11-21T12:16:37+00:00

Known Affected Software Configurations

VendorProductVersion range
RedhatLibuser≤ 0.56.13-5
RedhatLibuser0.60-1
RedhatLibuser0.60-2
RedhatLibuser0.60-3
RedhatLibuser0.60-4
RedhatLibuser0.60-5
RedhatLibuser0.60-6

References

Exploit-tagged references (not proof of a PoC)

Advisories

Technical & other

Sources: NVD · CVE.org · All sources and attribution · EPSS