CVE-2015-1862

moderate-risk

Published 2018-02-09

The crash reporting feature in Abrt allows local users to gain privileges by leveraging an execve by root after a chroot into a user-specified directory in a namedspaced environment.

Do I need to act?

4.7% chance of exploitation in next 30 days

EPSS score — moderate exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

2 public exploits available

36747, 36746

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 7.0/10 High

LOCAL / HIGH complexity

Affected Products (1)

Abrt

Affected Vendors

Abrt Project

References (20)

Exploit http://packetstormsecurity.com/files/131422/Fedora-abrt-Race-Condition.html

Exploit http://packetstormsecurity.com/files/131423/Linux-Apport-Abrt-Local-Root-Exploit...

Exploit http://packetstormsecurity.com/files/131429/Abrt-Apport-Race-Condition-Symlink.h...

Mailing List http://seclists.org/fulldisclosure/2015/Apr/34

Mailing List http://www.openwall.com/lists/oss-security/2015/04/14/4

Third Party Advisory http://www.securityfocus.com/bid/74263

Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=1211223

Issue Tracking https://github.com/abrt/abrt/pull/810

Exploit https://www.exploit-db.com/exploits/36746/

Exploit https://www.exploit-db.com/exploits/36747/