[Forgot Password]
Login  Register Subscribe

30389

 
 

423868

 
 

244625

 
 

909

 
 

193379

 
 

277

Paid content will be excluded from the download.


Download | Alert*
CVE
view JSON

CVE-2015-5287Date: (C)2015-12-15   (M)2023-12-22


The abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name, as demonstrated by /var/tmp/abrt/abrt-hax-coredump or /var/spool/abrt/abrt-hax-coredump.

CVSS Score and Metrics +CVSS Score and Metrics -

CVSS V2 Severity:
CVSS Score : 6.9
Exploit Score: 3.4
Impact Score: 10.0
 
CVSS V2 Metrics:
Access Vector: LOCAL
Access Complexity: MEDIUM
Authentication: NONE
Confidentiality: COMPLETE
Integrity: COMPLETE
Availability: COMPLETE
  
Reference:
EXPLOIT-DB-38832
BID-78137
RHSA-2015:2505
http://www.openwall.com/lists/oss-security/2015/12/01/1
http://packetstormsecurity.com/files/154592/ABRT-sosreport-Privilege-Escalation.html
http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
https://bugzilla.redhat.com/show_bug.cgi?id=1266837
https://github.com/abrt/abrt/commit/3c1b60cfa62d39e5fff5a53a5bc53dae189e740e

CPE    5
cpe:/o:redhat:enterprise_linux_hpc_node:7.0
cpe:/a:redhat:automatic_bug_reporting_tool
cpe:/o:redhat:enterprise_linux_workstation:7.0
cpe:/o:redhat:enterprise_linux_desktop:7.0
...
CWE    1
CWE-59
OVAL    5
oval:org.secpod.oval:def:1501260
oval:org.secpod.oval:def:204213
oval:org.secpod.oval:def:501711
oval:org.secpod.oval:def:204186
...

© SecPod Technologies