A race condition was found in the way abrt handled the directories used to store information about crashes. A local attacker with the privileges of the abrt user could use this flaw to perform a symbolic link attack, allowing them to make any file writable by the abrt user, allowing them to escalate their privileges to the privileged system user account, root.
This issue was assigned CVE-2012-5660.
Acknowledgements:
Red Hat would like to thank Martin Carpenter of Citco for reporting this issue.
Automatic Bug Reporting Tool (ABRT) before 2.1.6 allows local users to obtain sensitive information about arbitrary files via vectors related to sha1sums.
A vulnerability allowing to elevate privileges from the abrt user to root was reported. If a program starting with the name "abrt" crashes, abrt-hook-ccpp will write the coredump to /var/tmp/abrt/$filename-coredump or /var/spool/abrt/$filename-coredump. From abrt-hook-ccpp.c:
if (lastslash && strncmp(++lastslash, "abrt", 4) == 0) { / If abrtd/abrt-foo crashes, we don't want to create a directory, since that can make new copy of abrtd to process it, and maybe crash again... Unlike dirs, mere files are ignored by abrtd. / if (snprintf(path, sizeof(path), "%s/%s-coredump", gsettingsdumplocation, lastslash) >= sizeof(path)) errormsganddie("Error saving '%s': truncated long file path", path);
int abrtcorefd = xopen3(path, OWRONLY | OCREAT | OTRUNC, 0600);
The call to xopen3() does not include the flag ONOFOLLOW and is therefore vulnerable to a symlink attack.
This vulnerability is not exploitable on RHEL installations with default configuration. It can be exploitable if the system is configured to use non-RHN yum repositories. This is because yum is normally not usable by non-root users if the only configured repositories are RHN.
Note: This security flaw has been split from bug #1262252.
Automatic Bug Reporting Tool (ABRT) allows local users to read, change the ownership of, or have other unspecified impact on arbitrary files via a symlink attack on (1) /var/tmp/abrt//maps, (2) /tmp/jvm-/hserror.log, (3) /proc//exe, (4) /etc/os-release in a chroot, or (5) an unspecified root directory related to librpm.
abrt-dbus in Automatic Bug Reporting Tool (ABRT) allows local users to delete or change the ownership of arbitrary files via the problem directory argument to the (1) ChownProblemDir, (2) DeleteElement, or (3) DeleteProblem method.
It was discovered that the helper program, abrt-action-install-debuginfo-to-abrt-cache, does not properly filter the process environment (umask and truncated command line options) before invoking abrt-action-install-debuginfo. A local user could exploit this vulnerability to obtain root privileges.
Acknowledgements:
This issue was discovered by Florian Weimer of Red Hat Product Security.
daemon/abrt-handle-upload.in in Automatic Bug Reporting Tool (ABRT), when moving problem reports from /var/spool/abrt-upload, allows local users to write to arbitrary files or possibly have other unspecified impact via a symlink attack on (1) /var/spool/abrt or (2) /var/tmp/abrt.
It was discovered that the kernel-invoked coredump processor provided by abrt writes core dumps to files owned by other system users. This could result in information disclosure if an application crashes while its current directory is a directory writable to other users (such as /tmp).
Acknowledgement:
This issue was discovered by Florian Weimer of Red Hat Product Security.
Directory traversal vulnerability in abrt-dbus in Automatic Bug Reporting Tool (ABRT) allows local users to read, write to, or change ownership of arbitrary files via unspecified vectors to the (1) NewProblem, (2) GetInfo, (3) SetElement, or (4) DeleteElement method.