{"vulnerability": "CVE-2015-3245", "sightings": [{"uuid": "05554e54-0396-4e97-8386-5c2116bee833", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-3245", "type": "exploited", "source": "https://www.exploit-db.com/exploits/44633", "content": "", "creation_timestamp": "2018-05-16T00:00:00.000000Z"}, {"uuid": "e5527621-7172-48f4-a69e-0a79a0155c6a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-3245", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:42.000000Z"}, {"uuid": "37de81ed-1d1a-4eb2-be63-1b95e9150bf6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-3245", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:09:39.000000Z"}, {"uuid": "e4ec38ff-8974-407f-a7d9-f1dfda798500", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-3245", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/libuser_roothelper_priv_esc.rb", "content": "", "creation_timestamp": "2018-05-29T15:50:33.000000Z"}, {"uuid": "9ffd1b71-804e-4451-90da-56062b116538", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "db99543d-496c-4eef-ad0a-2df2093364df", "vulnerability": "CVE-2015-3245", "type": "confirmed", "source": "https://www.exploit-db.com/exploits/37706", "content": "", "creation_timestamp": "2015-07-27T00:00:00.000000Z"}, {"uuid": "9eb90542-5e9b-4eae-bff1-f095b8950ee2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-3245", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/libuser_roothelper_priv_esc.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"x86, x64\", \"author\": [\"Qualys\", \"bcoles \"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": true, \"default_credential\": false, \"description\": \"This module attempts to gain root privileges on Red Hat based Linux\\n          systems, including RHEL, Fedora and CentOS, by exploiting a newline\\n          injection vulnerability in libuser and userhelper versions prior to\\n          0.56.13-8 and version 0.60 before 0.60-7.\\n\\n          This module makes use of the roothelper.c exploit from Qualys to\\n          insert a new user with UID=0 in /etc/passwd.\\n\\n          Note, the password for the current user is required by userhelper.\\n\\n          Note, on some systems, such as Fedora 11, the user entry for the\\n          current user in /etc/passwd will become corrupted and exploitation\\n          will fail.\\n\\n          This module has been tested successfully on libuser packaged versions\\n          0.56.13-4.el6 on CentOS 6.0 (x86_64);\\n          0.56.13-5.el6 on CentOS 6.5 (x86_64);\\n          0.60-5.el7 on CentOS 7.1-1503 (x86_64);\\n          0.56.16-1.fc13 on Fedora 13 (i686);\\n          0.59-1.fc19 on Fedora Desktop 19 (x86_64);\\n          0.60-3.fc20 on Fedora Desktop 20 (x86_64);\\n          0.60-6.fc21 on Fedora Desktop 21 (x86_64);\\n          0.60-6.fc22 on Fedora Desktop 22 (x86_64);\\n          0.56.13-5.el6 on Red Hat 6.6 (x86_64); and\\n          0.60-5.el7 on Red Hat 7.0 (x86_64).\\n\\n          RHEL 5 is vulnerable, however the installed version of glibc (2.5)\\n          is missing various functions required by roothelper.c.\", \"disclosure_date\": \"2015-07-24\", \"fullname\": \"exploit/linux/local/libuser_roothelper_priv_esc\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:57:34 +0000\", \"name\": \"Libuser roothelper Privilege Escalation\", \"needs_cleanup\": true, \"notes\": {\"AKA\": [\"roothelper.c\"], \"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"artifacts-on-disk\"], \"Stability\": [\"service-resource-loss\"]}, \"path\": \"/modules/exploits/linux/local/libuser_roothelper_priv_esc.rb\", \"platform\": \"Linux\", \"post_auth\": true, \"rank\": 500, \"ref_name\": \"linux/local/libuser_roothelper_priv_esc\", \"references\": [\"EDB-37706\", \"CVE-2015-3245\", \"CVE-2015-3246\", \"BID-76021\", \"BID-76022\", \"URL-https://seclists.org/oss-sec/2015/q3/185\", \"URL-https://access.redhat.com/articles/1537873\"], \"rport\": null, \"session_types\": [\"shell\", \"meterpreter\"], \"targets\": [\"Auto\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:49:09.399383Z"}]}