CVE-2015-5287

ABRT sosreport Privilege Escalation

Severity Score

6.9

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

The abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name, as demonstrated by /var/tmp/abrt/abrt-hax-coredump or /var/spool/abrt/abrt-hax-coredump.

El programa de ayuda abrt-hook-ccpp en Automatic Bug Reporting Tool (ABRT) en versiones anteriores a 2.7.1 permite a usuarios locales con ciertos permisos obtener privilegios a través de un ataque de enlace simbólico en un archivo con un nombre predecible, según lo demostrado por /var/tmp/abrt/abrt-hax-coredump o /var/spool/abrt/abrt-hax-coredump.

It was discovered that the kernel-invoked coredump processor provided by ABRT did not handle symbolic links correctly when writing core dumps of ABRT programs to the ABRT dump directory (/var/spool/abrt). A local attacker with write access to an ABRT problem directory could use this flaw to escalate their privileges.

*Credits: N/A

CVSS Scores

NISTv2 6.9

Attack Vector

Local

Attack Complexity

Medium

Authentication

None

Confidentiality

Complete

Integrity

Complete

Availability

Complete

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2015-07-01 CVE Reserved
2015-11-23 CVE Published
2015-11-23 First Exploit
2023-03-08 EPSS Updated
2024-08-06 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-59: Improper Link Resolution Before File Access ('Link Following')

CAPEC

References (14)

URL	Tag	Source
http://packetstormsecurity.com/files/154592/ABRT-sosreport-Privilege-Escalation.html	X_refsource_misc
http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html	X_refsource_confirm
http://www.securityfocus.com/bid/78137	Vdb Entry
https://github.com/abrt/abrt/commit/3c1b60cfa62d39e5fff5a53a5bc53dae189e740e	X_refsource_confirm
https://www.openwall.com/lists/oss-security/2015/12/01/1
https://access.redhat.com/errata/RHSA-2015:2505

URL	Date	SRC
https://www.exploit-db.com/exploits/47421	2019-09-25
https://www.exploit-db.com/exploits/38832	2024-08-06
https://www.exploit-db.com/exploits/38835	2015-12-01
http://www.openwall.com/lists/oss-security/2015/12/01/1	2024-08-06
https://bugzilla.redhat.com/show_bug.cgi?id=1266837	2024-08-06
https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/local/abrt_sosreport_priv_esc.rb	2015-11-23

URL	Date	SRC

URL	Date	SRC
http://rhn.redhat.com/errata/RHSA-2015-2505.html	2016-12-07
https://access.redhat.com/security/cve/CVE-2015-5287	2015-11-23

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Redhat Search vendor "Redhat"		Automatic Bug Reporting Tool Search vendor "Redhat" for product "Automatic Bug Reporting Tool"				<= 2.7.0 Search vendor "Redhat" for product "Automatic Bug Reporting Tool" and version " <= 2.7.0"		-		Affected
Redhat Search vendor "Redhat"		Enterprise Linux Desktop Search vendor "Redhat" for product "Enterprise Linux Desktop"				7.0 Search vendor "Redhat" for product "Enterprise Linux Desktop" and version "7.0"		-		Affected
Redhat Search vendor "Redhat"		Enterprise Linux Hpc Node Search vendor "Redhat" for product "Enterprise Linux Hpc Node"				7.0 Search vendor "Redhat" for product "Enterprise Linux Hpc Node" and version "7.0"		-		Affected
Redhat Search vendor "Redhat"		Enterprise Linux Server Search vendor "Redhat" for product "Enterprise Linux Server"				7.0 Search vendor "Redhat" for product "Enterprise Linux Server" and version "7.0"		-		Affected
Redhat Search vendor "Redhat"		Enterprise Linux Workstation Search vendor "Redhat" for product "Enterprise Linux Workstation"				7.0 Search vendor "Redhat" for product "Enterprise Linux Workstation" and version "7.0"		-		Affected