CVE-2015-5287
published 2015-12-07CVE-2015-5287: The abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users with certain permissions to gain privileges via a…
PriorityP432medium6.9CVSS 2.0
AVLACMAuNCCICAC
EXPLOIT
EPSS
3.27%
87.0th percentile
The abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name, as demonstrated by /var/tmp/abrt/abrt-hax-coredump or /var/spool/abrt/abrt-hax-coredump.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | automatic_bug_reporting_tool | <= 2.7.0 | — |
| redhat | enterprise_linux_desktop | — | — |
| redhat | enterprise_linux_hpc_node | — | — |
| redhat | enterprise_linux_server | — | — |
| redhat | enterprise_linux_workstation | — | — |
CVSS provenance
nvdv2.06.9MEDIUMAV:L/AC:M/Au:N/C:C/I:C/A:C
vendor_redhat6.9MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
abrt: incorrect permissions on /var/spool/abrt
vendor_redhat·2015-11-23·CVSS 6.9
CVE-2015-5287 [MEDIUM] abrt: incorrect permissions on /var/spool/abrt
abrt: incorrect permissions on /var/spool/abrt
The abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name, as demonstrated by /var/tmp/abrt/abrt-hax-coredump or /var/spool/abrt/abrt-hax-coredump.
It was discovered that the kernel-invoked coredump processor provided by ABRT did not handle symbolic links correctly when writing core dumps of ABRT programs to the ABRT dump directory (/var/spool/abrt). A local attacker with write access to an ABRT problem directory could use this flaw to escalate their privileges.
Package: abrt (Red Hat Enterprise Linux 6) - Not affected
GHSA
GHSA-hf8c-7p7w-mch5: The abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2
ghsa_unreviewed·2022-05-17
CVE-2015-5287 [MEDIUM] CWE-59 GHSA-hf8c-7p7w-mch5: The abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2
The abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name, as demonstrated by /var/tmp/abrt/abrt-hax-coredump or /var/spool/abrt/abrt-hax-coredump.
No detection rules found.
Exploit-DB
ABRT - sosreport Privilege Escalation (Metasploit)
exploitdb·2019-09-25·CVSS 6.9
CVE-2015-5287 [MEDIUM] ABRT - sosreport Privilege Escalation (Metasploit)
ABRT - sosreport Privilege Escalation (Metasploit)
---
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule 'ABRT sosreport Privilege Escalation',
'Description' => %q{
This module attempts to gain root privileges on RHEL systems with
a vulnerable version of Automatic Bug Reporting Tool (ABRT) configured
as the crash handler.
`sosreport` uses an insecure temporary directory, allowing local users
to write to arbitrary files (CVE-2015-5287). This module uses a symlink
attack on `/var/tmp/abrt/cc-*$pid/` to overwrite the `modprobe` path
in `/proc/sys/kernel/modprobe`, resulting in root privileges.
Waiting for `sosreport` could take a few minutes.
This module has been tested success
Exploit-DB
RHEL 7.0/7.1 - 'abrt/sosreport' Local Privilege Escalation
exploitdb·2015-12-01·CVSS 6.9
CVE-2015-5287 [MEDIUM] RHEL 7.0/7.1 - 'abrt/sosreport' Local Privilege Escalation
RHEL 7.0/7.1 - 'abrt/sosreport' Local Privilege Escalation
---
#!/usr/bin/python
# CVE-2015-5287 (?)
# abrt/sosreport RHEL 7.0/7.1 local root
# rebel 09/2015
# [user@localhost ~]$ python sosreport-rhel7.py
# crashing pid 19143
# waiting for dump directory
# dump directory: /var/tmp/abrt/ccpp-2015-11-30-19:41:13-19143
# waiting for sosreport directory
# sosreport: sosreport-localhost.localdomain-20151130194114
# waiting for tmpfiles
# tmpfiles: ['tmpurfpyY', 'tmpYnCfnQ']
# moving directory
# moving tmpfiles
# tmpurfpyY -> tmpurfpyY.old
# tmpYnCfnQ -> tmpYnCfnQ.old
# waiting for sosreport to finish (can take several minutes)........................................done
# success
# bash-4.2# id
# uid=0(root) gid=1000(user) groups=0(root),1000(user) context=unconfined_u:unconfined_r:unconfin
Exploit-DB
abrt (Centos 7.1 / Fedora 22) - Local Privilege Escalation
exploitdb·2015-12-01·CVSS 3.6
CVE-2015-5287 [LOW] abrt (Centos 7.1 / Fedora 22) - Local Privilege Escalation
abrt (Centos 7.1 / Fedora 22) - Local Privilege Escalation
---
#!/usr/bin/python
# CVE-2015-5273 + CVE-2015-5287
# CENTOS 7.1/Fedora22 local root (probably works on SL and older versions too)
# abrt-hook-ccpp insecure open() usage + abrt-action-install-debuginfo insecure temp directory usage
# rebel 09/2015
# ----------------------------------------
# [user@localhost ~]$ id
# uid=1000(user) gid=1000(user) groups=1000(user) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
# [user@localhost ~]$ cat /etc/redhat-release
# CentOS Linux release 7.1.1503 (Core)
# [user@localhost ~]$ python abrt-centos-fedora.py
# -- lots of boring output, might take a while on a slow connection --
# /var/spool/abrt/abrt-hax-coredump created
# executing crashing process..
# success
# bash-4.2# id
#
Exploit-DB
Kemp Load Master 7.1.16 - Multiple Vulnerabilities
exploitdb·2015-04-02·CVSS 8.8
CVE-2014-7910 [HIGH] Kemp Load Master 7.1.16 - Multiple Vulnerabilities
Kemp Load Master 7.1.16 - Multiple Vulnerabilities
---
# Exploit Title: Kemp Load Master - Multiple Vulnerabilities (RCE, CSRF, XSS, DoS)
# Date: 01 April 2015
# Author: Roberto Suggi Liverani
# Software Link: http://kemptechnologies.com/load-balancer/
# Version: 7.1.16 and previous versions
# Tested on: Kemp Load Master 7.1-16
# CVE : CVE-2014-5287/5288
Link: http://blog.malerisch.net/2015/04/playing-with-kemp-load-master.html
Kemp virtual load master is a virtual load-balancer appliance which comes with a web administrative interface. I had a chance to test it and this blog post summarises some of the most interesting vulnerabilities I have discovered and which have not been published yet. For those of you who want to try it as well, you can get a free trial version here: http://kemp
Metasploit
ABRT sosreport Privilege Escalation
metasploit·CVSS 6.9
CVE-2015-5287 [MEDIUM] ABRT sosreport Privilege Escalation
ABRT sosreport Privilege Escalation
This module attempts to gain root privileges on RHEL systems with a vulnerable version of Automatic Bug Reporting Tool (ABRT) configured as the crash handler. `sosreport` uses an insecure temporary directory, allowing local users to write to arbitrary files (CVE-2015-5287). This module uses a symlink attack on `/var/tmp/abrt/cc-*$pid/` to overwrite the `modprobe` path in `/proc/sys/kernel/modprobe`, resulting in root privileges. Waiting for `sosreport` could take a few minutes. This module has been tested successfully on: abrt 2.1.11-12.el7 on RHEL 7.0 x86_64; and abrt 2.1.11-19.el7 on RHEL 7.1 x86_64.
Bugzilla
CVE-2015-5287 abrt: incorrect permissions on /var/spool/abrt
bugzilla·2015-09-28·CVSS 6.9
CVE-2015-5287 [MEDIUM] CVE-2015-5287 abrt: incorrect permissions on /var/spool/abrt
CVE-2015-5287 abrt: incorrect permissions on /var/spool/abrt
A vulnerability allowing to elevate privileges from the abrt user to root was reported.
If a program starting with the name "abrt" crashes, abrt-hook-ccpp will write the coredump to /var/tmp/abrt/$filename-coredump or /var/spool/abrt/$filename-coredump. From abrt-hook-ccpp.c:
if (last_slash && strncmp(++last_slash, "abrt", 4) == 0)
{
/* If abrtd/abrt-foo crashes, we don't want to create a _directory_,
* since that can make new copy of abrtd to process it,
* and maybe crash again...
* Unlike dirs, mere files are ignored by abrtd.
*/
if (snprintf(path, sizeof(path), "%s/%s-coredump", g_settings_dump_location, last_slash) >= sizeof(path))
error_msg_and_die("Error saving '%s': truncated long file path", path);
int abrt_core_fd = x
Bugzilla
CVE-2015-5273 abrt: Insecure temporary directory usage in abrt-action-install-debuginfo-to-abrt-cache
bugzilla·2015-09-11·CVSS 3.6
CVE-2015-5273 [LOW] CVE-2015-5273 abrt: Insecure temporary directory usage in abrt-action-install-debuginfo-to-abrt-cache
CVE-2015-5273 abrt: Insecure temporary directory usage in abrt-action-install-debuginfo-to-abrt-cache
Multiple vulnerabilities were found in abrt allowing privilege escalation.
1. Insecure temporary directory and symlink usage in sosreport
A vulnerability allowing to elevate privileges from an unprivileged user to root on a default installation of RHEL 7/7.1 was reported.
When a process receives SIGSEGV, abrt will save diagnostic information in /var/tmp/abrt/ccpp-*$pid on RHEL 7. Unless /etc/abrt/abrt.conf contains the line "PrivateReports = yes", directories created here by abrt will be chown()'d to the user who owned the crashing process. After saving some initial information it will call post-create scripts, one of the default ones on RHEL is /usr/sbin/sosreport. /usr/sbin/sosrepor
http://packetstormsecurity.com/files/154592/ABRT-sosreport-Privilege-Escalation.htmlhttp://rhn.redhat.com/errata/RHSA-2015-2505.htmlhttp://www.openwall.com/lists/oss-security/2015/12/01/1http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.htmlhttp://www.securityfocus.com/bid/78137https://bugzilla.redhat.com/show_bug.cgi?id=1266837https://github.com/abrt/abrt/commit/3c1b60cfa62d39e5fff5a53a5bc53dae189e740ehttps://www.exploit-db.com/exploits/38832/http://packetstormsecurity.com/files/154592/ABRT-sosreport-Privilege-Escalation.htmlhttp://rhn.redhat.com/errata/RHSA-2015-2505.htmlhttp://www.openwall.com/lists/oss-security/2015/12/01/1http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.htmlhttp://www.securityfocus.com/bid/78137https://bugzilla.redhat.com/show_bug.cgi?id=1266837https://github.com/abrt/abrt/commit/3c1b60cfa62d39e5fff5a53a5bc53dae189e740ehttps://www.exploit-db.com/exploits/38832/
2015-12-07
Published