PT-2015-6840 · Red Hat+1 · Libreport+2

Adam Mariš · CVE-2015-5302 · Publicado 2015-11-23 · Atualizado 2023-02-13

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions libreport versions 2.0.7 through 2.6.3

Description The issue allows remote attackers to obtain sensitive information via unspecified vectors related to the backtrace, cmdline, environ, open fds, maps, smaps, hostname, remote, ks.cfg, or anaconda-tb file attachment included in a Red Hat Bugzilla bug report. This occurs because libreport only saves changes to the first file when editing a crash report.

Recommendations For versions 2.0.7 through 2.6.3, update to version 2.6.3 or later to resolve the issue.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CESA-2015_2504

CESA-2015_2505

CVE-2015-5302

RHSA-2015:2504

RHSA-2015:2505

RHSA-2015_2504

RHSA-2015_2505

Produtos afetados

Centos

Red Hat

Libreport

Referências · 12

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/abrt_sosreport_priv_esc.rb · Exploit
• https://github.com/abrt/libreport/commit/257578a23d1537a2d235aaa2b1488ee4f818e360 · Nota
• http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172695.html · Aviso do Fabricante
• https://t.me/cvenotify/44186 · Publicação no Telegram
• http://securityfocus.com/bid/77685 · Nota
• https://linux.oracle.com/errata/ELSA-2015-2504.html · Aviso do Fabricante
• http://rhn.redhat.com/errata/RHSA-2015-2505.html · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=1270903 · Nota
• https://linux.oracle.com/errata/ELSA-2015-2505.html · Aviso do Fabricante
• http://rhn.redhat.com/errata/RHSA-2015-2504.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2015-5302 · Nota de Segurança
• http://oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html · Nota