daemon/abrt-handle-upload.in in Automatic Bug Reporting Tool (ABRT), when moving problem reports from /var/spool/abrt-upload, allows local users to write to arbitrary files or possibly have other unspecified impact via a symlink attack on (1) /var/spool/abrt or (2) /var/tmp/abrt.
Weakness
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Automatic_bug_reporting_tool | Redhat | - (including) | - (including) |
| Enterprise_linux_desktop | Redhat | 7.0 (including) | 7.0 (including) |
| Enterprise_linux_server | Redhat | 7.0 (including) | 7.0 (including) |
| Enterprise_linux_server_aus | Redhat | 7.3 (including) | 7.3 (including) |
| Enterprise_linux_server_aus | Redhat | 7.4 (including) | 7.4 (including) |
| Enterprise_linux_server_aus | Redhat | 7.6 (including) | 7.6 (including) |
| Enterprise_linux_server_aus | Redhat | 7.7 (including) | 7.7 (including) |
| Enterprise_linux_server_eus | Redhat | 7.1 (including) | 7.1 (including) |
| Enterprise_linux_server_eus | Redhat | 7.2 (including) | 7.2 (including) |
| Enterprise_linux_server_eus | Redhat | 7.3 (including) | 7.3 (including) |
| Enterprise_linux_server_eus | Redhat | 7.4 (including) | 7.4 (including) |
| Enterprise_linux_server_eus | Redhat | 7.5 (including) | 7.5 (including) |
| Enterprise_linux_server_eus | Redhat | 7.6 (including) | 7.6 (including) |
| Enterprise_linux_server_eus | Redhat | 7.7 (including) | 7.7 (including) |
| Enterprise_linux_server_tus | Redhat | 7.3 (including) | 7.3 (including) |
| Enterprise_linux_server_tus | Redhat | 7.6 (including) | 7.6 (including) |
| Enterprise_linux_server_tus | Redhat | 7.7 (including) | 7.7 (including) |
| Enterprise_linux_workstation | Redhat | 7.0 (including) | 7.0 (including) |
| Red Hat Enterprise Linux 6 | RedHat | abrt-0:2.0.8-26.el6_6.1 | * |
| Red Hat Enterprise Linux 6 | RedHat | libreport-0:2.0.9-21.el6_6.1 | * |
| Red Hat Enterprise Linux 7 | RedHat | abrt-0:2.1.11-22.el7_1 | * |
| Red Hat Enterprise Linux 7 | RedHat | libreport-0:2.1.11-23.el7_1 | * |
Potential Mitigations
- Follow the principle of least privilege when assigning access rights to entities in a software system.
- Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected areas that can be trusted.
Related Attack Patterns
- https://cwe.mitre.org/data/definitions/132.html
- https://cwe.mitre.org/data/definitions/17.html
- https://cwe.mitre.org/data/definitions/35.html
- https://cwe.mitre.org/data/definitions/76.html
References
- http://rhn.redhat.com/errata/RHSA-2015-1083.html
- http://www.openwall.com/lists/oss-security/2015/04/17/5
- https://bugzilla.redhat.com/show_bug.cgi?id=1212953
- https://github.com/abrt/abrt/commit/3746b7627218438ae7d781fc8b18a221454e9091
- https://github.com/abrt/abrt/pull/955
- http://rhn.redhat.com/errata/RHSA-2015-1083.html
- http://www.openwall.com/lists/oss-security/2015/04/17/5
- https://bugzilla.redhat.com/show_bug.cgi?id=1212953
- https://github.com/abrt/abrt/commit/3746b7627218438ae7d781fc8b18a221454e9091
- https://github.com/abrt/abrt/pull/955