PT-2015-6825 · Red Hat+1 · Abrt+2

Jakub Filak · Published 2015-11-23 · Updated 2023-02-13 · CVE-2015-5273

Positive Technologies (AI Summary)

CVSS v2.0

3.6

Low

Base vector

AV:L/AC:L/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions ABRT versions prior to 2.7.1

Description The issue allows local users to write to arbitrary files via a symlink attack on unpacked.cpio in a pre-created directory with a predictable name in /var/tmp. This is related to the abrt-action-install-debuginfo-to-abrt-cache help program in the Automatic Bug Reporting Tool (ABRT).

Recommendations For versions prior to 2.7.1, update to version 2.7.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the /var/tmp directory to minimize the risk of exploitation.

Exploit

Fix

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

CESA-2015_2505

CVE-2015-5273

RHSA-2015:2505

RHSA-2015_2505

Affected Products

Abrt

Centos

Red Hat

References · 11

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/abrt_sosreport_priv_esc.rb · Exploit
• 🔥 https://exploit-db.com/exploits/38835 · Exploit
• 🔥 https://bugzilla.redhat.com/show_bug.cgi?id=1262252 · Exploit
• 🔥 http://openwall.com/lists/oss-security/2015/12/01/1 · Exploit
• http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172809.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-2505.html · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2015-2505.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-5273 · Security Note
• https://github.com/abrt/abrt/commit/50ee8130fb4cd4ef1af7682a2c85dd99cb99424e · Note
• http://securityfocus.com/bid/78113 · Note
• http://oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html · Note