PT-2020-7834 · Abrt+2 · Abrt+2

Florian Weimer · Published 2015-06-09 · Updated 2023-02-13 · CVE-2015-3159

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: ABRT (affected versions not specified)

Description: The issue concerns the abrt-action-install-debuginfo-to-abrt-cache help program in the Automatic Bug Reporting Tool (ABRT), which fails to properly handle the process environment before invoking abrt-action-install-debuginfo. This allows local users to gain privileges.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CESA-2015_1083

CVE-2015-3159

RHSA-2015:1083

RHSA-2015:1210

RHSA-2015_1083

RHSA-2015_1210

Affected Products

Abrt

Centos

Red Hat

References · 7

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/abrt_raceabrt_priv_esc.rb · Exploit
• https://github.com/abrt/abrt/commit/9a4100678fea4d60ec93d35f4c5de2e9ad054f3a · Patch
• https://github.com/abrt/abrt/commit/9943a77bca37a0829ccd3784d1dfab37f8c24e7b · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2015-3159 · Security Note
• https://linux.oracle.com/errata/ELSA-2015-1210.html · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2015-1083.html · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1216962 · Note