Actively exploited · Published Dec 7, 2015 · Assigned by redhat
CVE-2015-5287
High 7.8 Exploited
In plain English
A high-severity security flaw in Automatic Bug Reporting Tool from Red Hat. Attackers are actively exploiting it in the wild (listed by CISA on August 26, 2026). The chance it is exploited in the next 30 days is estimated at 5.0% (higher than 92% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, public proof-of-concept code. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CISA guidance
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Federal agencies must remediate by Sep 9, 2026.
Official description
The abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name, as demonstrated by /var/tmp/abrt/abrt-hax-coredump or /var/spool/abrt/abrt-hax-coredump.
Affected products (as reported)
Weakness: CWE-59 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- RHSA-2015:2505 vendor-advisory, x_refsource_REDHAT
- 38832 exploit, x_refsource_EXPLOIT-DB
- [oss-security] 20151201 CVE-2015-5273 + CVE-2015-5287, abrt local root in Centos/Fedora/RHEL mailing-list, x_refsource_MLIST
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html x_refsource_CONFIRM
- https://bugzilla.redhat.com/show_bug.cgi?id=1266837 x_refsource_CONFIRM
- 78137 vdb-entry, x_refsource_BID
- https://github.com/abrt/abrt/commit/3c1b60cfa62d39e5fff5a53a5bc53dae189e740e x_refsource_CONFIRM
- http://packetstormsecurity.com/files/154592/ABRT-sosreport-Privilege-Escalation.html x_refsource_MISC
- https://blog.talosintelligence.com/uat-10147-chinese-speaking-adversary-integrates-agentic-ai-into-post-compromise-operations/ third-party-advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-5287 government-resource