CVE-2015-1870

CVSS V2 Low 2.1 CVSS V3 Medium 5.5
Description
The event scripts in Automatic Bug Reporting Tool (ABRT) uses world-readable permission on a copy of sosreport file in problem directories, which allows local users to obtain sensitive information from /var/log/messages via unspecified vectors.
Overview
  • CVE ID
  • CVE-2015-1870
  • Assigner
  • secalert@redhat.com
  • Vulnerability Status
  • Modified
  • Published Version
  • 2017-06-26T15:29:00
  • Last Modified Date
  • 2023-02-13T00:47:32
Weakness Enumerations
CWE URL
CWE-200 http://cwe.mitre.org/data/definitions/200.html
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
cpe:2.3:a:redhat:automatic_bug_reporting_tool:*:*:*:*:*:*:*:* 1 OR 2.1.11
CVSS Version 2
  • Version
  • 2.0
  • Vector String
  • AV:L/AC:L/Au:N/C:P/I:N/A:N
  • Access Vector
  • LOCAL
  • Access Compatibility
  • LOW
  • Authentication
  • NONE
  • Confidentiality Impact
  • PARTIAL
  • Integrity Impact
  • NONE
  • Availability Impact
  • NONE
  • Base Score
  • 2.1
  • Severity
  • LOW
  • Exploitability Score
  • 3.9
  • Impact Score
  • 2.9
CVSS Version 3
  • Version
  • 3.0
  • Vector String
  • CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
  • Attack Vector
  • LOCAL
  • Attack Compatibility
  • LOW
  • Privileges Required
  • LOW
  • User Interaction
  • NONE
  • Scope
  • UNCHANGED
  • Confidentiality Impact
  • HIGH
  • Availability Impact
  • NONE
  • Base Score
  • 5.5
  • Base Severity
  • MEDIUM
  • Exploitability Score
  • 1.8
  • Impact Score
  • 3.6
References
Reference URL Reference Tags
http://rhn.redhat.com/errata/RHSA-2015-1083.html Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2015-1210.html
http://www.securityfocus.com/bid/75119 Third Party Advisory VDB Entry
https://access.redhat.com/errata/RHSA-2015:1083
https://access.redhat.com/errata/RHSA-2015:1210
https://access.redhat.com/security/cve/CVE-2015-1870
https://bugzilla.redhat.com/show_bug.cgi?id=1212868 Issue Tracking Vendor Advisory
https://github.com/abrt/abrt/commit/7d023c32a565e83306cddf34c894477b7aaf33d1 Patch Third Party Advisory
https://github.com/abrt/abrt/commit/8939398b82006ba1fec4ed491339fc075f43fc7c Patch Third Party Advisory
https://github.com/abrt/libreport/commit/c962918bc70a61a8cc647898ee8b1ff1c14a87c5 Patch Third Party Advisory
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2015-1870
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1870
History
Created Old Value New Value Data Type Notes
2022-05-10 18:53:03 Added to TrackCVE
2022-12-02 18:05:39 2017-06-26T15:29Z 2017-06-26T15:29:00 CVE Published Date updated
2022-12-02 18:05:39 2018-01-05T02:30:00 CVE Modified Date updated
2022-12-02 18:05:39 Modified Vulnerability Status updated
2023-02-02 21:06:13 2023-02-02T20:20:19 CVE Modified Date updated
2023-02-02 21:06:14 The event scripts in Automatic Bug Reporting Tool (ABRT) uses world-readable permission on a copy of sosreport file in problem directories, which allows local users to obtain sensitive information from /var/log/messages via unspecified vectors. It was found that the ABRT event scripts created a user-readable copy of an sosreport file in ABRT problem directories, and included excerpts of /var/log/messages selected by the user-controlled process name, leading to an information disclosure. The fix for this issue prevents non-privileged users from accessing any crash reports, even reports of crashes of processes owned by those users. Only administrators (the wheel group members) are allowed to access crash reports via the "System" tab in the ABRT GUI, or by running abrt-cli as root (that is, via "sudo abrt-cli" or "su -c abrt-cli"). Description updated
2023-02-02 21:06:15 References updated
2023-02-13 01:07:03 2023-02-13T00:47:32 CVE Modified Date updated
2023-02-13 01:07:04 It was found that the ABRT event scripts created a user-readable copy of an sosreport file in ABRT problem directories, and included excerpts of /var/log/messages selected by the user-controlled process name, leading to an information disclosure. The fix for this issue prevents non-privileged users from accessing any crash reports, even reports of crashes of processes owned by those users. Only administrators (the wheel group members) are allowed to access crash reports via the "System" tab in the ABRT GUI, or by running abrt-cli as root (that is, via "sudo abrt-cli" or "su -c abrt-cli"). The event scripts in Automatic Bug Reporting Tool (ABRT) uses world-readable permission on a copy of sosreport file in problem directories, which allows local users to obtain sensitive information from /var/log/messages via unspecified vectors. Description updated