Vulnerabilities > CVE-2015-3159 - Unspecified vulnerability in Redhat Automatic BUG Reporting Tool

047910
CVSS 7.8 - HIGH
Attack vector
LOCAL
Attack complexity
LOW
Privileges required
LOW
Confidentiality impact
HIGH
Integrity impact
HIGH
Availability impact
HIGH
local
low complexity
redhat
nessus

Summary

The abrt-action-install-debuginfo-to-abrt-cache help program in Automatic Bug Reporting Tool (ABRT) does not properly handle the process environment before invoking abrt-action-install-debuginfo, which allows local users to gain privileges.

Vulnerable Configurations

Part Description Count
Application
Redhat
1

Nessus

  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2015-1210.NASL
    descriptionFrom Red Hat Security Advisory 2015:1210 : Updated abrt packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. ABRT (Automatic Bug Reporting Tool) is a tool to help users to detect defects in applications and to create a bug report with all the information needed by a maintainer to fix it. It uses a plug-in system to extend its functionality. It was found that ABRT was vulnerable to multiple race condition and symbolic link flaws. A local attacker could use these flaws to potentially escalate their privileges on the system. (CVE-2015-3315) It was discovered that the kernel-invoked coredump processor provided by ABRT wrote core dumps to files owned by other system users. This could result in information disclosure if an application crashed while its current directory was a directory writable to by other users (such as /tmp). (CVE-2015-3142) It was discovered that the default event handling scripts installed by ABRT did not handle symbolic links correctly. A local attacker with write access to an ABRT problem directory could use this flaw to escalate their privileges. (CVE-2015-1869) It was found that the ABRT event scripts created a user-readable copy of an sosreport file in ABRT problem directories, and included excerpts of /var/log/messages selected by the user-controlled process name, leading to an information disclosure. (CVE-2015-1870) It was discovered that, when moving problem reports between certain directories, abrt-handle-upload did not verify that the new problem directory had appropriate permissions and did not contain symbolic links. An attacker able to create a crafted problem report could use this flaw to expose other parts of ABRT, or to overwrite arbitrary files on the system. (CVE-2015-3147) It was discovered that the abrt-action-install-debuginfo-to-abrt-cache helper program did not properly filter the process environment before invoking abrt-action-install-debuginfo. A local attacker could use this flaw to escalate their privileges on the system. (CVE-2015-3159) The CVE-2015-1869, CVE-2015-1870, CVE-2015-3142, CVE-2015-3147, and CVE-2015-3159 issues were discovered by Florian Weimer of Red Hat Product Security. All users of abrt are advised to upgrade to these updated packages, which correct these issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id84608
    published2015-07-08
    reporterThis script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/84608
    titleOracle Linux 6 : abrt (ELSA-2015-1210)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Red Hat Security Advisory RHSA-2015:1210 and 
    # Oracle Linux Security Advisory ELSA-2015-1210 respectively.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(84608);
      script_version("2.11");
      script_cvs_date("Date: 2019/09/27 13:00:36");
    
      script_cve_id("CVE-2015-1869", "CVE-2015-1870", "CVE-2015-3142", "CVE-2015-3147", "CVE-2015-3159", "CVE-2015-3315");
      script_bugtraq_id(75116, 75117, 75118, 75119, 75128, 75129);
      script_xref(name:"RHSA", value:"2015:1210");
    
      script_name(english:"Oracle Linux 6 : abrt (ELSA-2015-1210)");
      script_summary(english:"Checks rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Oracle Linux host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "From Red Hat Security Advisory 2015:1210 :
    
    Updated abrt packages that fix multiple security issues are now
    available for Red Hat Enterprise Linux 6.
    
    Red Hat Product Security has rated this update as having Moderate
    security impact. Common Vulnerability Scoring System (CVSS) base
    scores, which give detailed severity ratings, are available for each
    vulnerability from the CVE links in the References section.
    
    ABRT (Automatic Bug Reporting Tool) is a tool to help users to detect
    defects in applications and to create a bug report with all the
    information needed by a maintainer to fix it. It uses a plug-in system
    to extend its functionality.
    
    It was found that ABRT was vulnerable to multiple race condition and
    symbolic link flaws. A local attacker could use these flaws to
    potentially escalate their privileges on the system. (CVE-2015-3315)
    
    It was discovered that the kernel-invoked coredump processor provided
    by ABRT wrote core dumps to files owned by other system users. This
    could result in information disclosure if an application crashed while
    its current directory was a directory writable to by other users (such
    as /tmp). (CVE-2015-3142)
    
    It was discovered that the default event handling scripts installed by
    ABRT did not handle symbolic links correctly. A local attacker with
    write access to an ABRT problem directory could use this flaw to
    escalate their privileges. (CVE-2015-1869)
    
    It was found that the ABRT event scripts created a user-readable copy
    of an sosreport file in ABRT problem directories, and included
    excerpts of /var/log/messages selected by the user-controlled process
    name, leading to an information disclosure. (CVE-2015-1870)
    
    It was discovered that, when moving problem reports between certain
    directories, abrt-handle-upload did not verify that the new problem
    directory had appropriate permissions and did not contain symbolic
    links. An attacker able to create a crafted problem report could use
    this flaw to expose other parts of ABRT, or to overwrite arbitrary
    files on the system. (CVE-2015-3147)
    
    It was discovered that the abrt-action-install-debuginfo-to-abrt-cache
    helper program did not properly filter the process environment before
    invoking abrt-action-install-debuginfo. A local attacker could use
    this flaw to escalate their privileges on the system. (CVE-2015-3159)
    
    The CVE-2015-1869, CVE-2015-1870, CVE-2015-3142, CVE-2015-3147, and
    CVE-2015-3159 issues were discovered by Florian Weimer of Red Hat
    Product Security.
    
    All users of abrt are advised to upgrade to these updated packages,
    which correct these issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://oss.oracle.com/pipermail/el-errata/2015-July/005191.html"
      );
      script_set_attribute(attribute:"solution", value:"Update the affected abrt packages.");
      script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"metasploit_name", value:'ABRT raceabrt Privilege Escalation');
      script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:abrt");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:abrt-addon-ccpp");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:abrt-addon-kerneloops");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:abrt-addon-python");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:abrt-addon-vmcore");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:abrt-cli");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:abrt-console-notification");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:abrt-desktop");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:abrt-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:abrt-gui");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:abrt-libs");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:abrt-python");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:abrt-tui");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:libreport");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:libreport-cli");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:libreport-compat");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:libreport-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:libreport-filesystem");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:libreport-gtk");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:libreport-gtk-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:libreport-newt");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:libreport-plugin-bugzilla");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:libreport-plugin-kerneloops");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:libreport-plugin-logger");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:libreport-plugin-mailx");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:libreport-plugin-reportuploader");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:libreport-python");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:oracle:linux:6");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2017/06/26");
      script_set_attribute(attribute:"patch_publication_date", value:"2015/07/07");
      script_set_attribute(attribute:"plugin_publication_date", value:"2015/07/08");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Oracle Linux Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/OracleLinux", "Host/RedHat/release", "Host/RedHat/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/OracleLinux")) audit(AUDIT_OS_NOT, "Oracle Linux");
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || !pregmatch(pattern: "Oracle (?:Linux Server|Enterprise Linux)", string:release)) audit(AUDIT_OS_NOT, "Oracle Linux");
    os_ver = pregmatch(pattern: "Oracle (?:Linux Server|Enterprise Linux) .*release ([0-9]+(\.[0-9]+)?)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Oracle Linux");
    os_ver = os_ver[1];
    if (! preg(pattern:"^6([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Oracle Linux 6", "Oracle Linux " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Oracle Linux", cpu);
    
    flag = 0;
    if (rpm_check(release:"EL6", reference:"abrt-2.0.8-26.0.1.el6_6.1")) flag++;
    if (rpm_check(release:"EL6", reference:"abrt-addon-ccpp-2.0.8-26.0.1.el6_6.1")) flag++;
    if (rpm_check(release:"EL6", reference:"abrt-addon-kerneloops-2.0.8-26.0.1.el6_6.1")) flag++;
    if (rpm_check(release:"EL6", reference:"abrt-addon-python-2.0.8-26.0.1.el6_6.1")) flag++;
    if (rpm_check(release:"EL6", reference:"abrt-addon-vmcore-2.0.8-26.0.1.el6_6.1")) flag++;
    if (rpm_check(release:"EL6", reference:"abrt-cli-2.0.8-26.0.1.el6_6.1")) flag++;
    if (rpm_check(release:"EL6", reference:"abrt-console-notification-2.0.8-26.0.1.el6_6.1")) flag++;
    if (rpm_check(release:"EL6", reference:"abrt-desktop-2.0.8-26.0.1.el6_6.1")) flag++;
    if (rpm_check(release:"EL6", reference:"abrt-devel-2.0.8-26.0.1.el6_6.1")) flag++;
    if (rpm_check(release:"EL6", reference:"abrt-gui-2.0.8-26.0.1.el6_6.1")) flag++;
    if (rpm_check(release:"EL6", reference:"abrt-libs-2.0.8-26.0.1.el6_6.1")) flag++;
    if (rpm_check(release:"EL6", reference:"abrt-python-2.0.8-26.0.1.el6_6.1")) flag++;
    if (rpm_check(release:"EL6", reference:"abrt-tui-2.0.8-26.0.1.el6_6.1")) flag++;
    if (rpm_check(release:"EL6", reference:"libreport-2.0.9-21.0.1.el6_6.1")) flag++;
    if (rpm_check(release:"EL6", reference:"libreport-cli-2.0.9-21.0.1.el6_6.1")) flag++;
    if (rpm_check(release:"EL6", reference:"libreport-compat-2.0.9-21.0.1.el6_6.1")) flag++;
    if (rpm_check(release:"EL6", reference:"libreport-devel-2.0.9-21.0.1.el6_6.1")) flag++;
    if (rpm_check(release:"EL6", reference:"libreport-filesystem-2.0.9-21.0.1.el6_6.1")) flag++;
    if (rpm_check(release:"EL6", reference:"libreport-gtk-2.0.9-21.0.1.el6_6.1")) flag++;
    if (rpm_check(release:"EL6", reference:"libreport-gtk-devel-2.0.9-21.0.1.el6_6.1")) flag++;
    if (rpm_check(release:"EL6", reference:"libreport-newt-2.0.9-21.0.1.el6_6.1")) flag++;
    if (rpm_check(release:"EL6", reference:"libreport-plugin-bugzilla-2.0.9-21.0.1.el6_6.1")) flag++;
    if (rpm_check(release:"EL6", reference:"libreport-plugin-kerneloops-2.0.9-21.0.1.el6_6.1")) flag++;
    if (rpm_check(release:"EL6", reference:"libreport-plugin-logger-2.0.9-21.0.1.el6_6.1")) flag++;
    if (rpm_check(release:"EL6", reference:"libreport-plugin-mailx-2.0.9-21.0.1.el6_6.1")) flag++;
    if (rpm_check(release:"EL6", reference:"libreport-plugin-reportuploader-2.0.9-21.0.1.el6_6.1")) flag++;
    if (rpm_check(release:"EL6", reference:"libreport-python-2.0.9-21.0.1.el6_6.1")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "abrt / abrt-addon-ccpp / abrt-addon-kerneloops / abrt-addon-python / etc");
    }
    
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2015-10193.NASL
    descriptionSecurity fixes for : - CVE-2015-3315 - CVE-2015-3142 - CVE-2015-1869 - CVE-2015-1870 - CVE-2015-3151 - CVE-2015-3150 - CVE-2015-3159 abrt: ===== - Move the default dump location from /var/tmp/abrt to /var/spool/abrt - Use root for owner of all dump directories - Stop reading hs_error.log from /tmp - Don not save the system logs by default - Don not save dmesg if kernel.dmesg_restrict=1 libreport: ========== - Harden the code against directory traversal, symbolic and hard link attacks - Fix a bug causing that the first value of AlwaysExcludedElements was ignored - Fix missing icon for the
    last seen2020-06-05
    modified2015-07-01
    plugin id84475
    published2015-07-01
    reporterThis script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/84475
    titleFedora 21 : abrt-2.3.0-7.fc21 / gnome-abrt-1.0.0-3.fc21 / libreport-2.3.0-8.fc21 (2015-10193)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Fedora Security Advisory 2015-10193.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(84475);
      script_version("2.6");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04");
    
      script_cve_id("CVE-2015-1869", "CVE-2015-1870", "CVE-2015-3142", "CVE-2015-3150", "CVE-2015-3151", "CVE-2015-3159", "CVE-2015-3315");
      script_xref(name:"FEDORA", value:"2015-10193");
    
      script_name(english:"Fedora 21 : abrt-2.3.0-7.fc21 / gnome-abrt-1.0.0-3.fc21 / libreport-2.3.0-8.fc21 (2015-10193)");
      script_summary(english:"Checks rpm output for the updated packages.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Fedora host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Security fixes for :
    
      - CVE-2015-3315
    
        - CVE-2015-3142
    
        - CVE-2015-1869
    
        - CVE-2015-1870
    
        - CVE-2015-3151
    
        - CVE-2015-3150
    
        - CVE-2015-3159
    
    abrt: =====
    
      - Move the default dump location from /var/tmp/abrt to
        /var/spool/abrt
    
        - Use root for owner of all dump directories
    
        - Stop reading hs_error.log from /tmp
    
        - Don not save the system logs by default
    
        - Don not save dmesg if kernel.dmesg_restrict=1
    
    libreport: ==========
    
      - Harden the code against directory traversal, symbolic
        and hard link attacks
    
        - Fix a bug causing that the first value of
          AlwaysExcludedElements was ignored
    
        - Fix missing icon for the 'Stop' button icon name
    
        - Improve development documentation
    
        - Translations updates
    
    gnome-abrt: ===========
    
      - Use DBus to get problem data for detail dialog
    
        - Fix an error introduced with the details on System
          page
    
        - Enabled the Details also for the System problems
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the Fedora security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.redhat.com/show_bug.cgi?id=1169774"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.redhat.com/show_bug.cgi?id=1179752"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.redhat.com/show_bug.cgi?id=1193656"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.redhat.com/show_bug.cgi?id=1212821"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.redhat.com/show_bug.cgi?id=1212865"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.redhat.com/show_bug.cgi?id=1212871"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.redhat.com/show_bug.cgi?id=1213485"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.redhat.com/show_bug.cgi?id=1214452"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.redhat.com/show_bug.cgi?id=1214609"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.redhat.com/show_bug.cgi?id=1216975"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.redhat.com/show_bug.cgi?id=1218239"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.redhat.com/show_bug.cgi?id=986876"
      );
      # https://lists.fedoraproject.org/pipermail/package-announce/2015-June/161245.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?9e916c0f"
      );
      # https://lists.fedoraproject.org/pipermail/package-announce/2015-June/161246.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?d3b69026"
      );
      # https://lists.fedoraproject.org/pipermail/package-announce/2015-June/161247.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?d7b58c5a"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected abrt, gnome-abrt and / or libreport packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"metasploit_name", value:'ABRT raceabrt Privilege Escalation');
      script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:abrt");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:gnome-abrt");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:libreport");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:21");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2017/06/26");
      script_set_attribute(attribute:"patch_publication_date", value:"2015/06/20");
      script_set_attribute(attribute:"plugin_publication_date", value:"2015/07/01");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Fedora Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora");
    os_ver = eregmatch(pattern: "Fedora.*release ([0-9]+)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora");
    os_ver = os_ver[1];
    if (! ereg(pattern:"^21([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 21.x", "Fedora " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu);
    
    flag = 0;
    if (rpm_check(release:"FC21", reference:"abrt-2.3.0-7.fc21")) flag++;
    if (rpm_check(release:"FC21", reference:"gnome-abrt-1.0.0-3.fc21")) flag++;
    if (rpm_check(release:"FC21", reference:"libreport-2.3.0-8.fc21")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "abrt / gnome-abrt / libreport");
    }
    
  • NASL familyScientific Linux Local Security Checks
    NASL idSL_20150707_ABRT_ON_SL6_X.NASL
    descriptionIt was found that ABRT was vulnerable to multiple race condition and symbolic link flaws. A local attacker could use these flaws to potentially escalate their privileges on the system. (CVE-2015-3315) It was discovered that the kernel-invoked coredump processor provided by ABRT wrote core dumps to files owned by other system users. This could result in information disclosure if an application crashed while its current directory was a directory writable to by other users (such as /tmp). (CVE-2015-3142) It was discovered that the default event handling scripts installed by ABRT did not handle symbolic links correctly. A local attacker with write access to an ABRT problem directory could use this flaw to escalate their privileges. (CVE-2015-1869) It was found that the ABRT event scripts created a user-readable copy of an sosreport file in ABRT problem directories, and included excerpts of /var/log/messages selected by the user-controlled process name, leading to an information disclosure. (CVE-2015-1870) It was discovered that, when moving problem reports between certain directories, abrt-handle-upload did not verify that the new problem directory had appropriate permissions and did not contain symbolic links. An attacker able to create a crafted problem report could use this flaw to expose other parts of ABRT, or to overwrite arbitrary files on the system. (CVE-2015-3147) It was discovered that the abrt-action-install-debuginfo-to-abrt-cache helper program did not properly filter the process environment before invoking abrt-action-install-debuginfo. A local attacker could use this flaw to escalate their privileges on the system. (CVE-2015-3159)
    last seen2020-03-18
    modified2015-07-08
    plugin id84611
    published2015-07-08
    reporterThis script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/84611
    titleScientific Linux Security Update : abrt on SL6.x i386/x86_64 (20150707)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text is (C) Scientific Linux.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(84611);
      script_version("2.7");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/02/25");
    
      script_cve_id("CVE-2015-1869", "CVE-2015-1870", "CVE-2015-3142", "CVE-2015-3147", "CVE-2015-3159", "CVE-2015-3315");
    
      script_name(english:"Scientific Linux Security Update : abrt on SL6.x i386/x86_64 (20150707)");
      script_summary(english:"Checks rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:
    "The remote Scientific Linux host is missing one or more security
    updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "It was found that ABRT was vulnerable to multiple race condition and
    symbolic link flaws. A local attacker could use these flaws to
    potentially escalate their privileges on the system. (CVE-2015-3315)
    
    It was discovered that the kernel-invoked coredump processor provided
    by ABRT wrote core dumps to files owned by other system users. This
    could result in information disclosure if an application crashed while
    its current directory was a directory writable to by other users (such
    as /tmp). (CVE-2015-3142)
    
    It was discovered that the default event handling scripts installed by
    ABRT did not handle symbolic links correctly. A local attacker with
    write access to an ABRT problem directory could use this flaw to
    escalate their privileges. (CVE-2015-1869)
    
    It was found that the ABRT event scripts created a user-readable copy
    of an sosreport file in ABRT problem directories, and included
    excerpts of /var/log/messages selected by the user-controlled process
    name, leading to an information disclosure. (CVE-2015-1870)
    
    It was discovered that, when moving problem reports between certain
    directories, abrt-handle-upload did not verify that the new problem
    directory had appropriate permissions and did not contain symbolic
    links. An attacker able to create a crafted problem report could use
    this flaw to expose other parts of ABRT, or to overwrite arbitrary
    files on the system. (CVE-2015-3147)
    
    It was discovered that the abrt-action-install-debuginfo-to-abrt-cache
    helper program did not properly filter the process environment before
    invoking abrt-action-install-debuginfo. A local attacker could use
    this flaw to escalate their privileges on the system. (CVE-2015-3159)"
      );
      # https://listserv.fnal.gov/scripts/wa.exe?A2=ind1507&L=scientific-linux-errata&F=&S=&P=5735
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?53b73d62"
      );
      script_set_attribute(attribute:"solution", value:"Update the affected packages.");
      script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"metasploit_name", value:'ABRT raceabrt Privilege Escalation');
      script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:abrt");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:abrt-addon-ccpp");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:abrt-addon-kerneloops");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:abrt-addon-python");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:abrt-addon-vmcore");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:abrt-cli");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:abrt-console-notification");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:abrt-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:abrt-desktop");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:abrt-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:abrt-gui");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:abrt-libs");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:abrt-python");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:abrt-tui");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:libreport");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:libreport-cli");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:libreport-compat");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:libreport-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:libreport-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:libreport-filesystem");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:libreport-gtk");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:libreport-gtk-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:libreport-newt");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:libreport-plugin-bugzilla");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:libreport-plugin-kerneloops");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:libreport-plugin-logger");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:libreport-plugin-mailx");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:libreport-plugin-reportuploader");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:libreport-plugin-rhtsupport");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:libreport-python");
      script_set_attribute(attribute:"cpe", value:"x-cpe:/o:fermilab:scientific_linux");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2017/06/26");
      script_set_attribute(attribute:"patch_publication_date", value:"2015/07/07");
      script_set_attribute(attribute:"plugin_publication_date", value:"2015/07/08");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Scientific Linux Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/RedHat/release", "Host/RedHat/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("misc_func.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Scientific Linux " >!< release) audit(AUDIT_HOST_NOT, "running Scientific Linux");
    os_ver = pregmatch(pattern: "Scientific Linux.*release ([0-9]+(\.[0-9]+)?)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Scientific Linux");
    os_ver = os_ver[1];
    if (! preg(pattern:"^6([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Scientific Linux 6.x", "Scientific Linux " + os_ver);
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if (cpu >!< "x86_64" && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Scientific Linux", cpu);
    
    
    flag = 0;
    if (rpm_check(release:"SL6", reference:"abrt-2.0.8-26.el6_6.1")) flag++;
    if (rpm_check(release:"SL6", reference:"abrt-addon-ccpp-2.0.8-26.el6_6.1")) flag++;
    if (rpm_check(release:"SL6", reference:"abrt-addon-kerneloops-2.0.8-26.el6_6.1")) flag++;
    if (rpm_check(release:"SL6", reference:"abrt-addon-python-2.0.8-26.el6_6.1")) flag++;
    if (rpm_check(release:"SL6", reference:"abrt-addon-vmcore-2.0.8-26.el6_6.1")) flag++;
    if (rpm_check(release:"SL6", reference:"abrt-cli-2.0.8-26.el6_6.1")) flag++;
    if (rpm_check(release:"SL6", reference:"abrt-console-notification-2.0.8-26.el6_6.1")) flag++;
    if (rpm_check(release:"SL6", reference:"abrt-debuginfo-2.0.8-26.el6_6.1")) flag++;
    if (rpm_check(release:"SL6", reference:"abrt-desktop-2.0.8-26.el6_6.1")) flag++;
    if (rpm_check(release:"SL6", reference:"abrt-devel-2.0.8-26.el6_6.1")) flag++;
    if (rpm_check(release:"SL6", reference:"abrt-gui-2.0.8-26.el6_6.1")) flag++;
    if (rpm_check(release:"SL6", reference:"abrt-libs-2.0.8-26.el6_6.1")) flag++;
    if (rpm_check(release:"SL6", reference:"abrt-python-2.0.8-26.el6_6.1")) flag++;
    if (rpm_check(release:"SL6", reference:"abrt-tui-2.0.8-26.el6_6.1")) flag++;
    if (rpm_check(release:"SL6", reference:"libreport-2.0.9-21.el6_6.1")) flag++;
    if (rpm_check(release:"SL6", reference:"libreport-cli-2.0.9-21.el6_6.1")) flag++;
    if (rpm_check(release:"SL6", reference:"libreport-compat-2.0.9-21.el6_6.1")) flag++;
    if (rpm_check(release:"SL6", reference:"libreport-debuginfo-2.0.9-21.el6_6.1")) flag++;
    if (rpm_check(release:"SL6", reference:"libreport-devel-2.0.9-21.el6_6.1")) flag++;
    if (rpm_check(release:"SL6", reference:"libreport-filesystem-2.0.9-21.el6_6.1")) flag++;
    if (rpm_check(release:"SL6", reference:"libreport-gtk-2.0.9-21.el6_6.1")) flag++;
    if (rpm_check(release:"SL6", reference:"libreport-gtk-devel-2.0.9-21.el6_6.1")) flag++;
    if (rpm_check(release:"SL6", reference:"libreport-newt-2.0.9-21.el6_6.1")) flag++;
    if (rpm_check(release:"SL6", reference:"libreport-plugin-bugzilla-2.0.9-21.el6_6.1")) flag++;
    if (rpm_check(release:"SL6", reference:"libreport-plugin-kerneloops-2.0.9-21.el6_6.1")) flag++;
    if (rpm_check(release:"SL6", reference:"libreport-plugin-logger-2.0.9-21.el6_6.1")) flag++;
    if (rpm_check(release:"SL6", reference:"libreport-plugin-mailx-2.0.9-21.el6_6.1")) flag++;
    if (rpm_check(release:"SL6", reference:"libreport-plugin-reportuploader-2.0.9-21.el6_6.1")) flag++;
    if (rpm_check(release:"SL6", reference:"libreport-plugin-rhtsupport-2.0.9-21.el6_6.1")) flag++;
    if (rpm_check(release:"SL6", reference:"libreport-python-2.0.9-21.el6_6.1")) flag++;
    
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_HOLE,
        extra      : rpm_report_get()
      );
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "abrt / abrt-addon-ccpp / abrt-addon-kerneloops / abrt-addon-python / etc");
    }
    
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2015-9886.NASL
    descriptionSecurity fixes for : - CVE-2015-3315 - CVE-2015-3142 - CVE-2015-1869 - CVE-2015-1870 - CVE-2015-3151 - CVE-2015-3150 - CVE-2015-3159 abrt : - Move the default dump location from /var/tmp/abrt to /var/spool/abrt - Use root for owner of all dump directories - Stop reading hs_error.log from /tmp - Don not save the system logs by default - Don not save dmesg if kernel.dmesg_restrict=1 libreport : - Harden the code against directory traversal, symbolic and hard link attacks - Fix a bug causing that the first value of AlwaysExcludedElements was ignored - Fix missing icon for the
    last seen2020-06-05
    modified2015-06-22
    plugin id84312
    published2015-06-22
    reporterThis script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/84312
    titleFedora 22 : abrt-2.6.0-1.fc22 / gnome-abrt-1.2.0-1.fc22 / libreport-2.6.0-1.fc22 / satyr-0.18-1.fc22 (2015-9886)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Fedora Security Advisory 2015-9886.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(84312);
      script_version("2.6");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04");
    
      script_cve_id("CVE-2015-1869", "CVE-2015-1870", "CVE-2015-3142", "CVE-2015-3150", "CVE-2015-3151", "CVE-2015-3159", "CVE-2015-3315");
      script_xref(name:"FEDORA", value:"2015-9886");
    
      script_name(english:"Fedora 22 : abrt-2.6.0-1.fc22 / gnome-abrt-1.2.0-1.fc22 / libreport-2.6.0-1.fc22 / satyr-0.18-1.fc22 (2015-9886)");
      script_summary(english:"Checks rpm output for the updated packages.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Fedora host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Security fixes for :
    
      - CVE-2015-3315
    
        - CVE-2015-3142
    
        - CVE-2015-1869
    
        - CVE-2015-1870
    
        - CVE-2015-3151
    
        - CVE-2015-3150
    
        - CVE-2015-3159
    
    abrt :
    
      - Move the default dump location from /var/tmp/abrt to
        /var/spool/abrt
    
        - Use root for owner of all dump directories
    
        - Stop reading hs_error.log from /tmp
    
        - Don not save the system logs by default
    
        - Don not save dmesg if kernel.dmesg_restrict=1
    
    libreport :
    
      - Harden the code against directory traversal, symbolic
        and hard link attacks
    
        - Fix a bug causing that the first value of
          AlwaysExcludedElements was ignored
    
        - Fix missing icon for the 'Stop' button icon name
    
        - Improve development documentation
    
        - Translations updates
    
    gnome-abrt :
    
      - Enabled the Details also for the System problems
    
        - Do not crash in the testing of availabitlity of
          XServer
    
        - Fix 'Open problem's data directory'
    
        - Quit Application on Ctrl+Q
    
        - Translation updates
    
    satyr :
    
      - New kernel taint flags
    
        - More secure core stacktraces from core hook
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the Fedora security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.redhat.com/show_bug.cgi?id=1128400"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.redhat.com/show_bug.cgi?id=1212821"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.redhat.com/show_bug.cgi?id=1212865"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.redhat.com/show_bug.cgi?id=1212871"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.redhat.com/show_bug.cgi?id=1214452"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.redhat.com/show_bug.cgi?id=1214609"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.redhat.com/show_bug.cgi?id=1216975"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.redhat.com/show_bug.cgi?id=1218239"
      );
      # https://lists.fedoraproject.org/pipermail/package-announce/2015-June/160568.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?c64f5b7d"
      );
      # https://lists.fedoraproject.org/pipermail/package-announce/2015-June/160569.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?b84b95df"
      );
      # https://lists.fedoraproject.org/pipermail/package-announce/2015-June/160570.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?b449c29f"
      );
      # https://lists.fedoraproject.org/pipermail/package-announce/2015-June/160571.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?ca41820c"
      );
      script_set_attribute(attribute:"solution", value:"Update the affected packages.");
      script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"metasploit_name", value:'ABRT raceabrt Privilege Escalation');
      script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:abrt");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:gnome-abrt");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:libreport");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:satyr");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:22");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2017/06/26");
      script_set_attribute(attribute:"patch_publication_date", value:"2015/06/13");
      script_set_attribute(attribute:"plugin_publication_date", value:"2015/06/22");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Fedora Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora");
    os_ver = eregmatch(pattern: "Fedora.*release ([0-9]+)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora");
    os_ver = os_ver[1];
    if (! ereg(pattern:"^22([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 22.x", "Fedora " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu);
    
    flag = 0;
    if (rpm_check(release:"FC22", reference:"abrt-2.6.0-1.fc22")) flag++;
    if (rpm_check(release:"FC22", reference:"gnome-abrt-1.2.0-1.fc22")) flag++;
    if (rpm_check(release:"FC22", reference:"libreport-2.6.0-1.fc22")) flag++;
    if (rpm_check(release:"FC22", reference:"satyr-0.18-1.fc22")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "abrt / gnome-abrt / libreport / satyr");
    }
    
  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2015-1083.NASL
    descriptionUpdated abrt packages that fix multiple security issues are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. ABRT (Automatic Bug Reporting Tool) is a tool to help users to detect defects in applications and to create a bug report with all the information needed by a maintainer to fix it. It uses a plug-in system to extend its functionality. It was found that ABRT was vulnerable to multiple race condition and symbolic link flaws. A local attacker could use these flaws to potentially escalate their privileges on the system. (CVE-2015-3315) It was discovered that the kernel-invoked coredump processor provided by ABRT wrote core dumps to files owned by other system users. This could result in information disclosure if an application crashed while its current directory was a directory writable to by other users (such as /tmp). (CVE-2015-3142) It was discovered that the default event handling scripts installed by ABRT did not handle symbolic links correctly. A local attacker with write access to an ABRT problem directory could use this flaw to escalate their privileges. (CVE-2015-1869) It was found that the ABRT event scripts created a user-readable copy of an sosreport file in ABRT problem directories, and included excerpts of /var/log/messages selected by the user-controlled process name, leading to an information disclosure. (CVE-2015-1870) It was discovered that, when moving problem reports between certain directories, abrt-handle-upload did not verify that the new problem directory had appropriate permissions and did not contain symbolic links. An attacker able to create a crafted problem report could use this flaw to expose other parts of ABRT to attack, or to overwrite arbitrary files on the system. (CVE-2015-3147) Multiple directory traversal flaws were found in the abrt-dbus D-Bus service. A local attacker could use these flaws to read and write arbitrary files as the root user. (CVE-2015-3151) It was discovered that the abrt-dbus D-Bus service did not properly check the validity of the problem directory argument in the ChownProblemDir, DeleteElement, and DeleteProblem methods. A local attacker could use this flaw to take ownership of arbitrary files and directories, or to delete files and directories as the root user. (CVE-2015-3150) It was discovered that the abrt-action-install-debuginfo-to-abrt-cache helper program did not properly filter the process environment before invoking abrt-action-install-debuginfo. A local attacker could use this flaw to escalate their privileges on the system. (CVE-2015-3159) All users of abrt are advised to upgrade to these updated packages, which correct these issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id84197
    published2015-06-16
    reporterThis script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/84197
    titleCentOS 7 : abrt (CESA-2015:1083)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Red Hat Security Advisory RHSA-2015:1083 and 
    # CentOS Errata and Security Advisory 2015:1083 respectively.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(84197);
      script_version("2.12");
      script_cvs_date("Date: 2020/01/02");
    
      script_cve_id("CVE-2015-1869", "CVE-2015-1870", "CVE-2015-3142", "CVE-2015-3147", "CVE-2015-3150", "CVE-2015-3151", "CVE-2015-3159", "CVE-2015-3315");
      script_bugtraq_id(75116, 75117, 75118, 75119, 75122, 75124, 75128, 75129);
      script_xref(name:"RHSA", value:"2015:1083");
    
      script_name(english:"CentOS 7 : abrt (CESA-2015:1083)");
      script_summary(english:"Checks rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote CentOS host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Updated abrt packages that fix multiple security issues are now
    available for Red Hat Enterprise Linux 7.
    
    Red Hat Product Security has rated this update as having Important
    security impact. A Common Vulnerability Scoring System (CVSS) base
    score, which gives a detailed severity rating, is available from the
    CVE link in the References section.
    
    ABRT (Automatic Bug Reporting Tool) is a tool to help users to detect
    defects in applications and to create a bug report with all the
    information needed by a maintainer to fix it. It uses a plug-in system
    to extend its functionality.
    
    It was found that ABRT was vulnerable to multiple race condition and
    symbolic link flaws. A local attacker could use these flaws to
    potentially escalate their privileges on the system. (CVE-2015-3315)
    
    It was discovered that the kernel-invoked coredump processor provided
    by ABRT wrote core dumps to files owned by other system users. This
    could result in information disclosure if an application crashed while
    its current directory was a directory writable to by other users (such
    as /tmp). (CVE-2015-3142)
    
    It was discovered that the default event handling scripts installed by
    ABRT did not handle symbolic links correctly. A local attacker with
    write access to an ABRT problem directory could use this flaw to
    escalate their privileges. (CVE-2015-1869)
    
    It was found that the ABRT event scripts created a user-readable copy
    of an sosreport file in ABRT problem directories, and included
    excerpts of /var/log/messages selected by the user-controlled process
    name, leading to an information disclosure. (CVE-2015-1870)
    
    It was discovered that, when moving problem reports between certain
    directories, abrt-handle-upload did not verify that the new problem
    directory had appropriate permissions and did not contain symbolic
    links. An attacker able to create a crafted problem report could use
    this flaw to expose other parts of ABRT to attack, or to overwrite
    arbitrary files on the system. (CVE-2015-3147)
    
    Multiple directory traversal flaws were found in the abrt-dbus D-Bus
    service. A local attacker could use these flaws to read and write
    arbitrary files as the root user. (CVE-2015-3151)
    
    It was discovered that the abrt-dbus D-Bus service did not properly
    check the validity of the problem directory argument in the
    ChownProblemDir, DeleteElement, and DeleteProblem methods. A local
    attacker could use this flaw to take ownership of arbitrary files and
    directories, or to delete files and directories as the root user.
    (CVE-2015-3150)
    
    It was discovered that the abrt-action-install-debuginfo-to-abrt-cache
    helper program did not properly filter the process environment before
    invoking abrt-action-install-debuginfo. A local attacker could use
    this flaw to escalate their privileges on the system. (CVE-2015-3159)
    
    All users of abrt are advised to upgrade to these updated packages,
    which correct these issues."
      );
      # https://lists.centos.org/pipermail/centos-announce/2015-June/021170.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?24a453ec"
      );
      script_set_attribute(attribute:"solution", value:"Update the affected abrt packages.");
      script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2015-3315");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"metasploit_name", value:'ABRT raceabrt Privilege Escalation');
      script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:abrt");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:abrt-addon-ccpp");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:abrt-addon-kerneloops");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:abrt-addon-pstoreoops");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:abrt-addon-python");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:abrt-addon-upload-watch");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:abrt-addon-vmcore");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:abrt-addon-xorg");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:abrt-cli");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:abrt-console-notification");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:abrt-dbus");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:abrt-desktop");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:abrt-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:abrt-gui");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:abrt-gui-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:abrt-gui-libs");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:abrt-libs");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:abrt-python");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:abrt-python-doc");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:abrt-retrace-client");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:abrt-tui");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:libreport");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:libreport-anaconda");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:libreport-centos");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:libreport-cli");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:libreport-compat");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:libreport-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:libreport-filesystem");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:libreport-gtk");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:libreport-gtk-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:libreport-newt");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:libreport-plugin-bugzilla");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:libreport-plugin-kerneloops");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:libreport-plugin-logger");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:libreport-plugin-mailx");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:libreport-plugin-mantisbt");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:libreport-plugin-reportuploader");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:libreport-plugin-rhtsupport");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:libreport-plugin-ureport");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:libreport-python");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:libreport-rhel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:libreport-rhel-anaconda-bugzilla");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:libreport-rhel-bugzilla");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:libreport-web");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:libreport-web-devel");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:centos:centos:7");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2017/06/26");
      script_set_attribute(attribute:"patch_publication_date", value:"2015/06/15");
      script_set_attribute(attribute:"plugin_publication_date", value:"2015/06/16");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"CentOS Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/CentOS/release", "Host/CentOS/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/CentOS/release");
    if (isnull(release) || "CentOS" >!< release) audit(AUDIT_OS_NOT, "CentOS");
    os_ver = pregmatch(pattern: "CentOS(?: Linux)? release ([0-9]+)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "CentOS");
    os_ver = os_ver[1];
    if (! preg(pattern:"^7([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "CentOS 7.x", "CentOS " + os_ver);
    
    if (!get_kb_item("Host/CentOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "CentOS", cpu);
    
    
    flag = 0;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"abrt-2.1.11-22.el7.centos.0.1")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"abrt-addon-ccpp-2.1.11-22.el7.centos.0.1")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"abrt-addon-kerneloops-2.1.11-22.el7.centos.0.1")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"abrt-addon-pstoreoops-2.1.11-22.el7.centos.0.1")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"abrt-addon-python-2.1.11-22.el7.centos.0.1")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"abrt-addon-upload-watch-2.1.11-22.el7.centos.0.1")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"abrt-addon-vmcore-2.1.11-22.el7.centos.0.1")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"abrt-addon-xorg-2.1.11-22.el7.centos.0.1")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"abrt-cli-2.1.11-22.el7.centos.0.1")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"abrt-console-notification-2.1.11-22.el7.centos.0.1")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"abrt-dbus-2.1.11-22.el7.centos.0.1")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"abrt-desktop-2.1.11-22.el7.centos.0.1")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"abrt-devel-2.1.11-22.el7.centos.0.1")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"abrt-gui-2.1.11-22.el7.centos.0.1")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"abrt-gui-devel-2.1.11-22.el7.centos.0.1")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"abrt-gui-libs-2.1.11-22.el7.centos.0.1")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"abrt-libs-2.1.11-22.el7.centos.0.1")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"abrt-python-2.1.11-22.el7.centos.0.1")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"abrt-python-doc-2.1.11-22.el7.centos.0.1")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"abrt-retrace-client-2.1.11-22.el7.centos.0.1")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"abrt-tui-2.1.11-22.el7.centos.0.1")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"libreport-2.1.11-23.el7.centos.0.1")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"libreport-anaconda-2.1.11-23.el7.centos.0.1")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"libreport-centos-2.1.11-23.el7.centos.0.1")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"libreport-cli-2.1.11-23.el7.centos.0.1")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"libreport-compat-2.1.11-23.el7.centos.0.1")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"libreport-devel-2.1.11-23.el7.centos.0.1")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"libreport-filesystem-2.1.11-23.el7.centos.0.1")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"libreport-gtk-2.1.11-23.el7.centos.0.1")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"libreport-gtk-devel-2.1.11-23.el7.centos.0.1")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"libreport-newt-2.1.11-23.el7.centos.0.1")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"libreport-plugin-bugzilla-2.1.11-23.el7.centos.0.1")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"libreport-plugin-kerneloops-2.1.11-23.el7.centos.0.1")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"libreport-plugin-logger-2.1.11-23.el7.centos.0.1")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"libreport-plugin-mailx-2.1.11-23.el7.centos.0.1")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"libreport-plugin-mantisbt-2.1.11-23.el7.centos.0.1")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"libreport-plugin-reportuploader-2.1.11-23.el7.centos.0.1")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"libreport-plugin-rhtsupport-2.1.11-23.el7.centos.0.1")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"libreport-plugin-ureport-2.1.11-23.el7.centos.0.1")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"libreport-python-2.1.11-23.el7.centos.0.1")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"libreport-rhel-2.1.11-23.el7.centos.0.1")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"libreport-rhel-anaconda-bugzilla-2.1.11-23.el7.centos.0.1")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"libreport-rhel-bugzilla-2.1.11-23.el7.centos.0.1")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"libreport-web-2.1.11-23.el7.centos.0.1")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"libreport-web-devel-2.1.11-23.el7.centos.0.1")) flag++;
    
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_HOLE,
        extra      : rpm_report_get()
      );
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "abrt / abrt-addon-ccpp / abrt-addon-kerneloops / etc");
    }
    
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2015-1083.NASL
    descriptionUpdated abrt packages that fix multiple security issues are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. ABRT (Automatic Bug Reporting Tool) is a tool to help users to detect defects in applications and to create a bug report with all the information needed by a maintainer to fix it. It uses a plug-in system to extend its functionality. It was found that ABRT was vulnerable to multiple race condition and symbolic link flaws. A local attacker could use these flaws to potentially escalate their privileges on the system. (CVE-2015-3315) It was discovered that the kernel-invoked coredump processor provided by ABRT wrote core dumps to files owned by other system users. This could result in information disclosure if an application crashed while its current directory was a directory writable to by other users (such as /tmp). (CVE-2015-3142) It was discovered that the default event handling scripts installed by ABRT did not handle symbolic links correctly. A local attacker with write access to an ABRT problem directory could use this flaw to escalate their privileges. (CVE-2015-1869) It was found that the ABRT event scripts created a user-readable copy of an sosreport file in ABRT problem directories, and included excerpts of /var/log/messages selected by the user-controlled process name, leading to an information disclosure. (CVE-2015-1870) It was discovered that, when moving problem reports between certain directories, abrt-handle-upload did not verify that the new problem directory had appropriate permissions and did not contain symbolic links. An attacker able to create a crafted problem report could use this flaw to expose other parts of ABRT to attack, or to overwrite arbitrary files on the system. (CVE-2015-3147) Multiple directory traversal flaws were found in the abrt-dbus D-Bus service. A local attacker could use these flaws to read and write arbitrary files as the root user. (CVE-2015-3151) It was discovered that the abrt-dbus D-Bus service did not properly check the validity of the problem directory argument in the ChownProblemDir, DeleteElement, and DeleteProblem methods. A local attacker could use this flaw to take ownership of arbitrary files and directories, or to delete files and directories as the root user. (CVE-2015-3150) It was discovered that the abrt-action-install-debuginfo-to-abrt-cache helper program did not properly filter the process environment before invoking abrt-action-install-debuginfo. A local attacker could use this flaw to escalate their privileges on the system. (CVE-2015-3159) All users of abrt are advised to upgrade to these updated packages, which correct these issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id84077
    published2015-06-10
    reporterThis script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/84077
    titleRHEL 7 : abrt (RHSA-2015:1083)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Red Hat Security Advisory RHSA-2015:1083. The text 
    # itself is copyright (C) Red Hat, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(84077);
      script_version("2.18");
      script_cvs_date("Date: 2019/10/24 15:35:40");
    
      script_cve_id("CVE-2015-1869", "CVE-2015-1870", "CVE-2015-3142", "CVE-2015-3147", "CVE-2015-3150", "CVE-2015-3151", "CVE-2015-3159", "CVE-2015-3315");
      script_bugtraq_id(75116, 75117, 75118, 75119, 75122, 75124, 75128, 75129);
      script_xref(name:"RHSA", value:"2015:1083");
    
      script_name(english:"RHEL 7 : abrt (RHSA-2015:1083)");
      script_summary(english:"Checks the rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Red Hat host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Updated abrt packages that fix multiple security issues are now
    available for Red Hat Enterprise Linux 7.
    
    Red Hat Product Security has rated this update as having Important
    security impact. A Common Vulnerability Scoring System (CVSS) base
    score, which gives a detailed severity rating, is available from the
    CVE link in the References section.
    
    ABRT (Automatic Bug Reporting Tool) is a tool to help users to detect
    defects in applications and to create a bug report with all the
    information needed by a maintainer to fix it. It uses a plug-in system
    to extend its functionality.
    
    It was found that ABRT was vulnerable to multiple race condition and
    symbolic link flaws. A local attacker could use these flaws to
    potentially escalate their privileges on the system. (CVE-2015-3315)
    
    It was discovered that the kernel-invoked coredump processor provided
    by ABRT wrote core dumps to files owned by other system users. This
    could result in information disclosure if an application crashed while
    its current directory was a directory writable to by other users (such
    as /tmp). (CVE-2015-3142)
    
    It was discovered that the default event handling scripts installed by
    ABRT did not handle symbolic links correctly. A local attacker with
    write access to an ABRT problem directory could use this flaw to
    escalate their privileges. (CVE-2015-1869)
    
    It was found that the ABRT event scripts created a user-readable copy
    of an sosreport file in ABRT problem directories, and included
    excerpts of /var/log/messages selected by the user-controlled process
    name, leading to an information disclosure. (CVE-2015-1870)
    
    It was discovered that, when moving problem reports between certain
    directories, abrt-handle-upload did not verify that the new problem
    directory had appropriate permissions and did not contain symbolic
    links. An attacker able to create a crafted problem report could use
    this flaw to expose other parts of ABRT to attack, or to overwrite
    arbitrary files on the system. (CVE-2015-3147)
    
    Multiple directory traversal flaws were found in the abrt-dbus D-Bus
    service. A local attacker could use these flaws to read and write
    arbitrary files as the root user. (CVE-2015-3151)
    
    It was discovered that the abrt-dbus D-Bus service did not properly
    check the validity of the problem directory argument in the
    ChownProblemDir, DeleteElement, and DeleteProblem methods. A local
    attacker could use this flaw to take ownership of arbitrary files and
    directories, or to delete files and directories as the root user.
    (CVE-2015-3150)
    
    It was discovered that the abrt-action-install-debuginfo-to-abrt-cache
    helper program did not properly filter the process environment before
    invoking abrt-action-install-debuginfo. A local attacker could use
    this flaw to escalate their privileges on the system. (CVE-2015-3159)
    
    All users of abrt are advised to upgrade to these updated packages,
    which correct these issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/errata/RHSA-2015:1083"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2015-3315"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2015-1870"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2015-3150"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2015-3151"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2015-3142"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2015-1869"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2015-3147"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2015-3159"
      );
      script_set_attribute(attribute:"solution", value:"Update the affected packages.");
      script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"metasploit_name", value:'ABRT raceabrt Privilege Escalation');
      script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:abrt");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:abrt-addon-ccpp");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:abrt-addon-kerneloops");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:abrt-addon-pstoreoops");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:abrt-addon-python");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:abrt-addon-upload-watch");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:abrt-addon-vmcore");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:abrt-addon-xorg");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:abrt-cli");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:abrt-console-notification");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:abrt-dbus");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:abrt-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:abrt-desktop");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:abrt-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:abrt-gui");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:abrt-gui-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:abrt-gui-libs");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:abrt-libs");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:abrt-python");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:abrt-python-doc");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:abrt-retrace-client");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:abrt-tui");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:libreport");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:libreport-anaconda");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:libreport-cli");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:libreport-compat");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:libreport-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:libreport-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:libreport-filesystem");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:libreport-gtk");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:libreport-gtk-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:libreport-newt");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:libreport-plugin-bugzilla");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:libreport-plugin-kerneloops");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:libreport-plugin-logger");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:libreport-plugin-mailx");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:libreport-plugin-reportuploader");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:libreport-plugin-rhtsupport");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:libreport-plugin-ureport");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:libreport-python");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:libreport-rhel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:libreport-rhel-anaconda-bugzilla");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:libreport-rhel-bugzilla");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:libreport-web");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:libreport-web-devel");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:7");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:7.1");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:7.2");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:7.3");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:7.4");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:7.5");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:7.6");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:7.7");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2017/06/26");
      script_set_attribute(attribute:"patch_publication_date", value:"2015/06/09");
      script_set_attribute(attribute:"plugin_publication_date", value:"2015/06/10");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Red Hat Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("misc_func.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Red Hat" >!< release) audit(AUDIT_OS_NOT, "Red Hat");
    os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Red Hat");
    os_ver = os_ver[1];
    if (! preg(pattern:"^7([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Red Hat 7.x", "Red Hat " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "s390" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Red Hat", cpu);
    
    yum_updateinfo = get_kb_item("Host/RedHat/yum-updateinfo");
    if (!empty_or_null(yum_updateinfo)) 
    {
      rhsa = "RHSA-2015:1083";
      yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);
      if (!empty_or_null(yum_report))
      {
        security_report_v4(
          port       : 0,
          severity   : SECURITY_HOLE,
          extra      : yum_report 
        );
        exit(0);
      }
      else
      {
        audit_message = "affected by Red Hat security advisory " + rhsa;
        audit(AUDIT_OS_NOT, audit_message);
      }
    }
    else
    {
      flag = 0;
      if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"abrt-2.1.11-22.el7_1")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"abrt-2.1.11-22.el7_1")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"abrt-addon-ccpp-2.1.11-22.el7_1")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"abrt-addon-ccpp-2.1.11-22.el7_1")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"abrt-addon-kerneloops-2.1.11-22.el7_1")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"abrt-addon-kerneloops-2.1.11-22.el7_1")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"abrt-addon-pstoreoops-2.1.11-22.el7_1")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"abrt-addon-pstoreoops-2.1.11-22.el7_1")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"abrt-addon-python-2.1.11-22.el7_1")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"abrt-addon-python-2.1.11-22.el7_1")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"abrt-addon-upload-watch-2.1.11-22.el7_1")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"abrt-addon-upload-watch-2.1.11-22.el7_1")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"abrt-addon-vmcore-2.1.11-22.el7_1")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"abrt-addon-vmcore-2.1.11-22.el7_1")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"abrt-addon-xorg-2.1.11-22.el7_1")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"abrt-addon-xorg-2.1.11-22.el7_1")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"abrt-cli-2.1.11-22.el7_1")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"abrt-cli-2.1.11-22.el7_1")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"abrt-console-notification-2.1.11-22.el7_1")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"abrt-console-notification-2.1.11-22.el7_1")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"abrt-dbus-2.1.11-22.el7_1")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"abrt-dbus-2.1.11-22.el7_1")) flag++;
    
      if (rpm_check(release:"RHEL7", reference:"abrt-debuginfo-2.1.11-22.el7_1")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"abrt-desktop-2.1.11-22.el7_1")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"abrt-desktop-2.1.11-22.el7_1")) flag++;
    
      if (rpm_check(release:"RHEL7", reference:"abrt-devel-2.1.11-22.el7_1")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"abrt-gui-2.1.11-22.el7_1")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"abrt-gui-2.1.11-22.el7_1")) flag++;
    
      if (rpm_check(release:"RHEL7", reference:"abrt-gui-devel-2.1.11-22.el7_1")) flag++;
    
      if (rpm_check(release:"RHEL7", reference:"abrt-gui-libs-2.1.11-22.el7_1")) flag++;
    
      if (rpm_check(release:"RHEL7", reference:"abrt-libs-2.1.11-22.el7_1")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"abrt-python-2.1.11-22.el7_1")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"abrt-python-2.1.11-22.el7_1")) flag++;
    
      if (rpm_check(release:"RHEL7", reference:"abrt-python-doc-2.1.11-22.el7_1")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"abrt-retrace-client-2.1.11-22.el7_1")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"abrt-retrace-client-2.1.11-22.el7_1")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"abrt-tui-2.1.11-22.el7_1")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"abrt-tui-2.1.11-22.el7_1")) flag++;
    
      if (rpm_check(release:"RHEL7", reference:"libreport-2.1.11-23.el7_1")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"libreport-anaconda-2.1.11-23.el7_1")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"libreport-anaconda-2.1.11-23.el7_1")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"libreport-cli-2.1.11-23.el7_1")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"libreport-cli-2.1.11-23.el7_1")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"libreport-compat-2.1.11-23.el7_1")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"libreport-compat-2.1.11-23.el7_1")) flag++;
    
      if (rpm_check(release:"RHEL7", reference:"libreport-debuginfo-2.1.11-23.el7_1")) flag++;
    
      if (rpm_check(release:"RHEL7", reference:"libreport-devel-2.1.11-23.el7_1")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"libreport-filesystem-2.1.11-23.el7_1")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"libreport-filesystem-2.1.11-23.el7_1")) flag++;
    
      if (rpm_check(release:"RHEL7", reference:"libreport-gtk-2.1.11-23.el7_1")) flag++;
    
      if (rpm_check(release:"RHEL7", reference:"libreport-gtk-devel-2.1.11-23.el7_1")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"libreport-newt-2.1.11-23.el7_1")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"libreport-newt-2.1.11-23.el7_1")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"libreport-plugin-bugzilla-2.1.11-23.el7_1")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"libreport-plugin-bugzilla-2.1.11-23.el7_1")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"libreport-plugin-kerneloops-2.1.11-23.el7_1")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"libreport-plugin-kerneloops-2.1.11-23.el7_1")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"libreport-plugin-logger-2.1.11-23.el7_1")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"libreport-plugin-logger-2.1.11-23.el7_1")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"libreport-plugin-mailx-2.1.11-23.el7_1")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"libreport-plugin-mailx-2.1.11-23.el7_1")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"libreport-plugin-reportuploader-2.1.11-23.el7_1")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"libreport-plugin-reportuploader-2.1.11-23.el7_1")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"libreport-plugin-rhtsupport-2.1.11-23.el7_1")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"libreport-plugin-rhtsupport-2.1.11-23.el7_1")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"libreport-plugin-ureport-2.1.11-23.el7_1")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"libreport-plugin-ureport-2.1.11-23.el7_1")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"libreport-python-2.1.11-23.el7_1")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"libreport-python-2.1.11-23.el7_1")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"libreport-rhel-2.1.11-23.el7_1")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"libreport-rhel-2.1.11-23.el7_1")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"libreport-rhel-anaconda-bugzilla-2.1.11-23.el7_1")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"libreport-rhel-anaconda-bugzilla-2.1.11-23.el7_1")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"libreport-rhel-bugzilla-2.1.11-23.el7_1")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"libreport-rhel-bugzilla-2.1.11-23.el7_1")) flag++;
    
      if (rpm_check(release:"RHEL7", reference:"libreport-web-2.1.11-23.el7_1")) flag++;
    
      if (rpm_check(release:"RHEL7", reference:"libreport-web-devel-2.1.11-23.el7_1")) flag++;
    
    
      if (flag)
      {
        security_report_v4(
          port       : 0,
          severity   : SECURITY_HOLE,
          extra      : rpm_report_get() + redhat_report_package_caveat()
        );
        exit(0);
      }
      else
      {
        tested = pkg_tests_get();
        if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
        else audit(AUDIT_PACKAGE_NOT_INSTALLED, "abrt / abrt-addon-ccpp / abrt-addon-kerneloops / etc");
      }
    }
    
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2015-1210.NASL
    descriptionUpdated abrt packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. ABRT (Automatic Bug Reporting Tool) is a tool to help users to detect defects in applications and to create a bug report with all the information needed by a maintainer to fix it. It uses a plug-in system to extend its functionality. It was found that ABRT was vulnerable to multiple race condition and symbolic link flaws. A local attacker could use these flaws to potentially escalate their privileges on the system. (CVE-2015-3315) It was discovered that the kernel-invoked coredump processor provided by ABRT wrote core dumps to files owned by other system users. This could result in information disclosure if an application crashed while its current directory was a directory writable to by other users (such as /tmp). (CVE-2015-3142) It was discovered that the default event handling scripts installed by ABRT did not handle symbolic links correctly. A local attacker with write access to an ABRT problem directory could use this flaw to escalate their privileges. (CVE-2015-1869) It was found that the ABRT event scripts created a user-readable copy of an sosreport file in ABRT problem directories, and included excerpts of /var/log/messages selected by the user-controlled process name, leading to an information disclosure. (CVE-2015-1870) It was discovered that, when moving problem reports between certain directories, abrt-handle-upload did not verify that the new problem directory had appropriate permissions and did not contain symbolic links. An attacker able to create a crafted problem report could use this flaw to expose other parts of ABRT, or to overwrite arbitrary files on the system. (CVE-2015-3147) It was discovered that the abrt-action-install-debuginfo-to-abrt-cache helper program did not properly filter the process environment before invoking abrt-action-install-debuginfo. A local attacker could use this flaw to escalate their privileges on the system. (CVE-2015-3159) The CVE-2015-1869, CVE-2015-1870, CVE-2015-3142, CVE-2015-3147, and CVE-2015-3159 issues were discovered by Florian Weimer of Red Hat Product Security. All users of abrt are advised to upgrade to these updated packages, which correct these issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id84609
    published2015-07-08
    reporterThis script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/84609
    titleRHEL 6 : abrt (RHSA-2015:1210)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Red Hat Security Advisory RHSA-2015:1210. The text 
    # itself is copyright (C) Red Hat, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(84609);
      script_version("2.13");
      script_cvs_date("Date: 2019/10/24 15:35:40");
    
      script_cve_id("CVE-2015-1869", "CVE-2015-1870", "CVE-2015-3142", "CVE-2015-3147", "CVE-2015-3159", "CVE-2015-3315");
      script_bugtraq_id(75116, 75117, 75118, 75119, 75128, 75129);
      script_xref(name:"RHSA", value:"2015:1210");
    
      script_name(english:"RHEL 6 : abrt (RHSA-2015:1210)");
      script_summary(english:"Checks the rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Red Hat host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Updated abrt packages that fix multiple security issues are now
    available for Red Hat Enterprise Linux 6.
    
    Red Hat Product Security has rated this update as having Moderate
    security impact. Common Vulnerability Scoring System (CVSS) base
    scores, which give detailed severity ratings, are available for each
    vulnerability from the CVE links in the References section.
    
    ABRT (Automatic Bug Reporting Tool) is a tool to help users to detect
    defects in applications and to create a bug report with all the
    information needed by a maintainer to fix it. It uses a plug-in system
    to extend its functionality.
    
    It was found that ABRT was vulnerable to multiple race condition and
    symbolic link flaws. A local attacker could use these flaws to
    potentially escalate their privileges on the system. (CVE-2015-3315)
    
    It was discovered that the kernel-invoked coredump processor provided
    by ABRT wrote core dumps to files owned by other system users. This
    could result in information disclosure if an application crashed while
    its current directory was a directory writable to by other users (such
    as /tmp). (CVE-2015-3142)
    
    It was discovered that the default event handling scripts installed by
    ABRT did not handle symbolic links correctly. A local attacker with
    write access to an ABRT problem directory could use this flaw to
    escalate their privileges. (CVE-2015-1869)
    
    It was found that the ABRT event scripts created a user-readable copy
    of an sosreport file in ABRT problem directories, and included
    excerpts of /var/log/messages selected by the user-controlled process
    name, leading to an information disclosure. (CVE-2015-1870)
    
    It was discovered that, when moving problem reports between certain
    directories, abrt-handle-upload did not verify that the new problem
    directory had appropriate permissions and did not contain symbolic
    links. An attacker able to create a crafted problem report could use
    this flaw to expose other parts of ABRT, or to overwrite arbitrary
    files on the system. (CVE-2015-3147)
    
    It was discovered that the abrt-action-install-debuginfo-to-abrt-cache
    helper program did not properly filter the process environment before
    invoking abrt-action-install-debuginfo. A local attacker could use
    this flaw to escalate their privileges on the system. (CVE-2015-3159)
    
    The CVE-2015-1869, CVE-2015-1870, CVE-2015-3142, CVE-2015-3147, and
    CVE-2015-3159 issues were discovered by Florian Weimer of Red Hat
    Product Security.
    
    All users of abrt are advised to upgrade to these updated packages,
    which correct these issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/errata/RHSA-2015:1210"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2015-3315"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2015-1870"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2015-3142"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2015-1869"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2015-3147"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2015-3159"
      );
      script_set_attribute(attribute:"solution", value:"Update the affected packages.");
      script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"metasploit_name", value:'ABRT raceabrt Privilege Escalation');
      script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:abrt");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:abrt-addon-ccpp");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:abrt-addon-kerneloops");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:abrt-addon-python");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:abrt-addon-vmcore");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:abrt-cli");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:abrt-console-notification");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:abrt-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:abrt-desktop");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:abrt-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:abrt-gui");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:abrt-libs");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:abrt-python");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:abrt-tui");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:libreport");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:libreport-cli");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:libreport-compat");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:libreport-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:libreport-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:libreport-filesystem");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:libreport-gtk");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:libreport-gtk-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:libreport-newt");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:libreport-plugin-bugzilla");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:libreport-plugin-kerneloops");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:libreport-plugin-logger");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:libreport-plugin-mailx");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:libreport-plugin-reportuploader");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:libreport-plugin-rhtsupport");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:libreport-python");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:6");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:6.6");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2017/06/26");
      script_set_attribute(attribute:"patch_publication_date", value:"2015/07/07");
      script_set_attribute(attribute:"plugin_publication_date", value:"2015/07/08");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Red Hat Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("misc_func.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Red Hat" >!< release) audit(AUDIT_OS_NOT, "Red Hat");
    os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Red Hat");
    os_ver = os_ver[1];
    if (! preg(pattern:"^6([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Red Hat 6.x", "Red Hat " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "s390" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Red Hat", cpu);
    
    yum_updateinfo = get_kb_item("Host/RedHat/yum-updateinfo");
    if (!empty_or_null(yum_updateinfo)) 
    {
      rhsa = "RHSA-2015:1210";
      yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);
      if (!empty_or_null(yum_report))
      {
        security_report_v4(
          port       : 0,
          severity   : SECURITY_HOLE,
          extra      : yum_report 
        );
        exit(0);
      }
      else
      {
        audit_message = "affected by Red Hat security advisory " + rhsa;
        audit(AUDIT_OS_NOT, audit_message);
      }
    }
    else
    {
      flag = 0;
      if (rpm_check(release:"RHEL6", cpu:"i686", reference:"abrt-2.0.8-26.el6_6.1")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"abrt-2.0.8-26.el6_6.1")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"abrt-2.0.8-26.el6_6.1")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"i686", reference:"abrt-addon-ccpp-2.0.8-26.el6_6.1")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"abrt-addon-ccpp-2.0.8-26.el6_6.1")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"abrt-addon-ccpp-2.0.8-26.el6_6.1")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"i686", reference:"abrt-addon-kerneloops-2.0.8-26.el6_6.1")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"abrt-addon-kerneloops-2.0.8-26.el6_6.1")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"abrt-addon-kerneloops-2.0.8-26.el6_6.1")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"i686", reference:"abrt-addon-python-2.0.8-26.el6_6.1")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"abrt-addon-python-2.0.8-26.el6_6.1")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"abrt-addon-python-2.0.8-26.el6_6.1")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"i686", reference:"abrt-addon-vmcore-2.0.8-26.el6_6.1")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"abrt-addon-vmcore-2.0.8-26.el6_6.1")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"abrt-addon-vmcore-2.0.8-26.el6_6.1")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"i686", reference:"abrt-cli-2.0.8-26.el6_6.1")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"abrt-cli-2.0.8-26.el6_6.1")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"abrt-cli-2.0.8-26.el6_6.1")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"i686", reference:"abrt-console-notification-2.0.8-26.el6_6.1")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"abrt-console-notification-2.0.8-26.el6_6.1")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"abrt-console-notification-2.0.8-26.el6_6.1")) flag++;
    
      if (rpm_check(release:"RHEL6", reference:"abrt-debuginfo-2.0.8-26.el6_6.1")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"i686", reference:"abrt-desktop-2.0.8-26.el6_6.1")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"abrt-desktop-2.0.8-26.el6_6.1")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"abrt-desktop-2.0.8-26.el6_6.1")) flag++;
    
      if (rpm_check(release:"RHEL6", reference:"abrt-devel-2.0.8-26.el6_6.1")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"i686", reference:"abrt-gui-2.0.8-26.el6_6.1")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"abrt-gui-2.0.8-26.el6_6.1")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"abrt-gui-2.0.8-26.el6_6.1")) flag++;
    
      if (rpm_check(release:"RHEL6", reference:"abrt-libs-2.0.8-26.el6_6.1")) flag++;
    
      if (rpm_check(release:"RHEL6", reference:"abrt-python-2.0.8-26.el6_6.1")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"i686", reference:"abrt-tui-2.0.8-26.el6_6.1")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"abrt-tui-2.0.8-26.el6_6.1")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"abrt-tui-2.0.8-26.el6_6.1")) flag++;
    
      if (rpm_check(release:"RHEL6", reference:"libreport-2.0.9-21.el6_6.1")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"i686", reference:"libreport-cli-2.0.9-21.el6_6.1")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"libreport-cli-2.0.9-21.el6_6.1")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"libreport-cli-2.0.9-21.el6_6.1")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"i686", reference:"libreport-compat-2.0.9-21.el6_6.1")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"libreport-compat-2.0.9-21.el6_6.1")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"libreport-compat-2.0.9-21.el6_6.1")) flag++;
    
      if (rpm_check(release:"RHEL6", reference:"libreport-debuginfo-2.0.9-21.el6_6.1")) flag++;
    
      if (rpm_check(release:"RHEL6", reference:"libreport-devel-2.0.9-21.el6_6.1")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"i686", reference:"libreport-filesystem-2.0.9-21.el6_6.1")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"libreport-filesystem-2.0.9-21.el6_6.1")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"libreport-filesystem-2.0.9-21.el6_6.1")) flag++;
    
      if (rpm_check(release:"RHEL6", reference:"libreport-gtk-2.0.9-21.el6_6.1")) flag++;
    
      if (rpm_check(release:"RHEL6", reference:"libreport-gtk-devel-2.0.9-21.el6_6.1")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"i686", reference:"libreport-newt-2.0.9-21.el6_6.1")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"libreport-newt-2.0.9-21.el6_6.1")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"libreport-newt-2.0.9-21.el6_6.1")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"i686", reference:"libreport-plugin-bugzilla-2.0.9-21.el6_6.1")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"libreport-plugin-bugzilla-2.0.9-21.el6_6.1")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"libreport-plugin-bugzilla-2.0.9-21.el6_6.1")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"i686", reference:"libreport-plugin-kerneloops-2.0.9-21.el6_6.1")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"libreport-plugin-kerneloops-2.0.9-21.el6_6.1")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"libreport-plugin-kerneloops-2.0.9-21.el6_6.1")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"i686", reference:"libreport-plugin-logger-2.0.9-21.el6_6.1")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"libreport-plugin-logger-2.0.9-21.el6_6.1")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"libreport-plugin-logger-2.0.9-21.el6_6.1")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"i686", reference:"libreport-plugin-mailx-2.0.9-21.el6_6.1")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"libreport-plugin-mailx-2.0.9-21.el6_6.1")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"libreport-plugin-mailx-2.0.9-21.el6_6.1")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"i686", reference:"libreport-plugin-reportuploader-2.0.9-21.el6_6.1")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"libreport-plugin-reportuploader-2.0.9-21.el6_6.1")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"libreport-plugin-reportuploader-2.0.9-21.el6_6.1")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"i686", reference:"libreport-plugin-rhtsupport-2.0.9-21.el6_6.1")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"libreport-plugin-rhtsupport-2.0.9-21.el6_6.1")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"libreport-plugin-rhtsupport-2.0.9-21.el6_6.1")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"i686", reference:"libreport-python-2.0.9-21.el6_6.1")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"libreport-python-2.0.9-21.el6_6.1")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"libreport-python-2.0.9-21.el6_6.1")) flag++;
    
    
      if (flag)
      {
        security_report_v4(
          port       : 0,
          severity   : SECURITY_HOLE,
          extra      : rpm_report_get() + redhat_report_package_caveat()
        );
        exit(0);
      }
      else
      {
        tested = pkg_tests_get();
        if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
        else audit(AUDIT_PACKAGE_NOT_INSTALLED, "abrt / abrt-addon-ccpp / abrt-addon-kerneloops / abrt-addon-python / etc");
      }
    }
    
  • NASL familyScientific Linux Local Security Checks
    NASL idSL_20150609_ABRT_ON_SL7_X.NASL
    descriptionIt was found that ABRT was vulnerable to multiple race condition and symbolic link flaws. A local attacker could use these flaws to potentially escalate their privileges on the system. (CVE-2015-3315) It was discovered that the kernel-invoked coredump processor provided by ABRT wrote core dumps to files owned by other system users. This could result in information disclosure if an application crashed while its current directory was a directory writable to by other users (such as /tmp). (CVE-2015-3142) It was discovered that the default event handling scripts installed by ABRT did not handle symbolic links correctly. A local attacker with write access to an ABRT problem directory could use this flaw to escalate their privileges. (CVE-2015-1869) It was found that the ABRT event scripts created a user-readable copy of an sosreport file in ABRT problem directories, and included excerpts of /var/log/messages selected by the user-controlled process name, leading to an information disclosure. (CVE-2015-1870) It was discovered that, when moving problem reports between certain directories, abrt-handle-upload did not verify that the new problem directory had appropriate permissions and did not contain symbolic links. An attacker able to create a crafted problem report could use this flaw to expose other parts of ABRT to attack, or to overwrite arbitrary files on the system. (CVE-2015-3147) Multiple directory traversal flaws were found in the abrt-dbus D-Bus service. A local attacker could use these flaws to read and write arbitrary files as the root user. (CVE-2015-3151) It was discovered that the abrt-dbus D-Bus service did not properly check the validity of the problem directory argument in the ChownProblemDir, DeleteElement, and DeleteProblem methods. A local attacker could use this flaw to take ownership of arbitrary files and directories, or to delete files and directories as the root user. (CVE-2015-3150) It was discovered that the abrt-action-install-debuginfo-to-abrt-cache helper program did not properly filter the process environment before invoking abrt-action-install-debuginfo. A local attacker could use this flaw to escalate their privileges on the system. (CVE-2015-3159)
    last seen2020-03-18
    modified2015-06-11
    plugin id84113
    published2015-06-11
    reporterThis script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/84113
    titleScientific Linux Security Update : abrt on SL7.x x86_64 (20150609)
  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2015-1083.NASL
    descriptionFrom Red Hat Security Advisory 2015:1083 : Updated abrt packages that fix multiple security issues are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. ABRT (Automatic Bug Reporting Tool) is a tool to help users to detect defects in applications and to create a bug report with all the information needed by a maintainer to fix it. It uses a plug-in system to extend its functionality. It was found that ABRT was vulnerable to multiple race condition and symbolic link flaws. A local attacker could use these flaws to potentially escalate their privileges on the system. (CVE-2015-3315) It was discovered that the kernel-invoked coredump processor provided by ABRT wrote core dumps to files owned by other system users. This could result in information disclosure if an application crashed while its current directory was a directory writable to by other users (such as /tmp). (CVE-2015-3142) It was discovered that the default event handling scripts installed by ABRT did not handle symbolic links correctly. A local attacker with write access to an ABRT problem directory could use this flaw to escalate their privileges. (CVE-2015-1869) It was found that the ABRT event scripts created a user-readable copy of an sosreport file in ABRT problem directories, and included excerpts of /var/log/messages selected by the user-controlled process name, leading to an information disclosure. (CVE-2015-1870) It was discovered that, when moving problem reports between certain directories, abrt-handle-upload did not verify that the new problem directory had appropriate permissions and did not contain symbolic links. An attacker able to create a crafted problem report could use this flaw to expose other parts of ABRT to attack, or to overwrite arbitrary files on the system. (CVE-2015-3147) Multiple directory traversal flaws were found in the abrt-dbus D-Bus service. A local attacker could use these flaws to read and write arbitrary files as the root user. (CVE-2015-3151) It was discovered that the abrt-dbus D-Bus service did not properly check the validity of the problem directory argument in the ChownProblemDir, DeleteElement, and DeleteProblem methods. A local attacker could use this flaw to take ownership of arbitrary files and directories, or to delete files and directories as the root user. (CVE-2015-3150) It was discovered that the abrt-action-install-debuginfo-to-abrt-cache helper program did not properly filter the process environment before invoking abrt-action-install-debuginfo. A local attacker could use this flaw to escalate their privileges on the system. (CVE-2015-3159) All users of abrt are advised to upgrade to these updated packages, which correct these issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id84074
    published2015-06-10
    reporterThis script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/84074
    titleOracle Linux 7 : abrt (ELSA-2015-1083)

Redhat

rpms
  • abrt-0:2.1.11-22.ael7b_1
  • abrt-0:2.1.11-22.el7_1
  • abrt-addon-ccpp-0:2.1.11-22.ael7b_1
  • abrt-addon-ccpp-0:2.1.11-22.el7_1
  • abrt-addon-kerneloops-0:2.1.11-22.ael7b_1
  • abrt-addon-kerneloops-0:2.1.11-22.el7_1
  • abrt-addon-pstoreoops-0:2.1.11-22.ael7b_1
  • abrt-addon-pstoreoops-0:2.1.11-22.el7_1
  • abrt-addon-python-0:2.1.11-22.ael7b_1
  • abrt-addon-python-0:2.1.11-22.el7_1
  • abrt-addon-upload-watch-0:2.1.11-22.ael7b_1
  • abrt-addon-upload-watch-0:2.1.11-22.el7_1
  • abrt-addon-vmcore-0:2.1.11-22.ael7b_1
  • abrt-addon-vmcore-0:2.1.11-22.el7_1
  • abrt-addon-xorg-0:2.1.11-22.ael7b_1
  • abrt-addon-xorg-0:2.1.11-22.el7_1
  • abrt-cli-0:2.1.11-22.ael7b_1
  • abrt-cli-0:2.1.11-22.el7_1
  • abrt-console-notification-0:2.1.11-22.ael7b_1
  • abrt-console-notification-0:2.1.11-22.el7_1
  • abrt-dbus-0:2.1.11-22.ael7b_1
  • abrt-dbus-0:2.1.11-22.el7_1
  • abrt-debuginfo-0:2.1.11-22.ael7b_1
  • abrt-debuginfo-0:2.1.11-22.el7_1
  • abrt-desktop-0:2.1.11-22.ael7b_1
  • abrt-desktop-0:2.1.11-22.el7_1
  • abrt-devel-0:2.1.11-22.ael7b_1
  • abrt-devel-0:2.1.11-22.el7_1
  • abrt-gui-0:2.1.11-22.ael7b_1
  • abrt-gui-0:2.1.11-22.el7_1
  • abrt-gui-devel-0:2.1.11-22.ael7b_1
  • abrt-gui-devel-0:2.1.11-22.el7_1
  • abrt-gui-libs-0:2.1.11-22.ael7b_1
  • abrt-gui-libs-0:2.1.11-22.el7_1
  • abrt-libs-0:2.1.11-22.ael7b_1
  • abrt-libs-0:2.1.11-22.el7_1
  • abrt-python-0:2.1.11-22.ael7b_1
  • abrt-python-0:2.1.11-22.el7_1
  • abrt-python-doc-0:2.1.11-22.ael7b_1
  • abrt-python-doc-0:2.1.11-22.el7_1
  • abrt-retrace-client-0:2.1.11-22.ael7b_1
  • abrt-retrace-client-0:2.1.11-22.el7_1
  • abrt-tui-0:2.1.11-22.ael7b_1
  • abrt-tui-0:2.1.11-22.el7_1
  • libreport-0:2.1.11-23.ael7b_1
  • libreport-0:2.1.11-23.el7_1
  • libreport-anaconda-0:2.1.11-23.ael7b_1
  • libreport-anaconda-0:2.1.11-23.el7_1
  • libreport-cli-0:2.1.11-23.ael7b_1
  • libreport-cli-0:2.1.11-23.el7_1
  • libreport-compat-0:2.1.11-23.ael7b_1
  • libreport-compat-0:2.1.11-23.el7_1
  • libreport-debuginfo-0:2.1.11-23.ael7b_1
  • libreport-debuginfo-0:2.1.11-23.el7_1
  • libreport-devel-0:2.1.11-23.ael7b_1
  • libreport-devel-0:2.1.11-23.el7_1
  • libreport-filesystem-0:2.1.11-23.ael7b_1
  • libreport-filesystem-0:2.1.11-23.el7_1
  • libreport-gtk-0:2.1.11-23.ael7b_1
  • libreport-gtk-0:2.1.11-23.el7_1
  • libreport-gtk-devel-0:2.1.11-23.ael7b_1
  • libreport-gtk-devel-0:2.1.11-23.el7_1
  • libreport-newt-0:2.1.11-23.ael7b_1
  • libreport-newt-0:2.1.11-23.el7_1
  • libreport-plugin-bugzilla-0:2.1.11-23.ael7b_1
  • libreport-plugin-bugzilla-0:2.1.11-23.el7_1
  • libreport-plugin-kerneloops-0:2.1.11-23.ael7b_1
  • libreport-plugin-kerneloops-0:2.1.11-23.el7_1
  • libreport-plugin-logger-0:2.1.11-23.ael7b_1
  • libreport-plugin-logger-0:2.1.11-23.el7_1
  • libreport-plugin-mailx-0:2.1.11-23.ael7b_1
  • libreport-plugin-mailx-0:2.1.11-23.el7_1
  • libreport-plugin-reportuploader-0:2.1.11-23.ael7b_1
  • libreport-plugin-reportuploader-0:2.1.11-23.el7_1
  • libreport-plugin-rhtsupport-0:2.1.11-23.ael7b_1
  • libreport-plugin-rhtsupport-0:2.1.11-23.el7_1
  • libreport-plugin-ureport-0:2.1.11-23.ael7b_1
  • libreport-plugin-ureport-0:2.1.11-23.el7_1
  • libreport-python-0:2.1.11-23.ael7b_1
  • libreport-python-0:2.1.11-23.el7_1
  • libreport-rhel-0:2.1.11-23.ael7b_1
  • libreport-rhel-0:2.1.11-23.el7_1
  • libreport-rhel-anaconda-bugzilla-0:2.1.11-23.ael7b_1
  • libreport-rhel-anaconda-bugzilla-0:2.1.11-23.el7_1
  • libreport-rhel-bugzilla-0:2.1.11-23.ael7b_1
  • libreport-rhel-bugzilla-0:2.1.11-23.el7_1
  • libreport-web-0:2.1.11-23.ael7b_1
  • libreport-web-0:2.1.11-23.el7_1
  • libreport-web-devel-0:2.1.11-23.ael7b_1
  • libreport-web-devel-0:2.1.11-23.el7_1
  • abrt-0:2.0.8-26.el6_6.1
  • abrt-addon-ccpp-0:2.0.8-26.el6_6.1
  • abrt-addon-kerneloops-0:2.0.8-26.el6_6.1
  • abrt-addon-python-0:2.0.8-26.el6_6.1
  • abrt-addon-vmcore-0:2.0.8-26.el6_6.1
  • abrt-cli-0:2.0.8-26.el6_6.1
  • abrt-console-notification-0:2.0.8-26.el6_6.1
  • abrt-debuginfo-0:2.0.8-26.el6_6.1
  • abrt-desktop-0:2.0.8-26.el6_6.1
  • abrt-devel-0:2.0.8-26.el6_6.1
  • abrt-gui-0:2.0.8-26.el6_6.1
  • abrt-libs-0:2.0.8-26.el6_6.1
  • abrt-python-0:2.0.8-26.el6_6.1
  • abrt-tui-0:2.0.8-26.el6_6.1
  • libreport-0:2.0.9-21.el6_6.1
  • libreport-cli-0:2.0.9-21.el6_6.1
  • libreport-compat-0:2.0.9-21.el6_6.1
  • libreport-debuginfo-0:2.0.9-21.el6_6.1
  • libreport-devel-0:2.0.9-21.el6_6.1
  • libreport-filesystem-0:2.0.9-21.el6_6.1
  • libreport-gtk-0:2.0.9-21.el6_6.1
  • libreport-gtk-devel-0:2.0.9-21.el6_6.1
  • libreport-newt-0:2.0.9-21.el6_6.1
  • libreport-plugin-bugzilla-0:2.0.9-21.el6_6.1
  • libreport-plugin-kerneloops-0:2.0.9-21.el6_6.1
  • libreport-plugin-logger-0:2.0.9-21.el6_6.1
  • libreport-plugin-mailx-0:2.0.9-21.el6_6.1
  • libreport-plugin-reportuploader-0:2.0.9-21.el6_6.1
  • libreport-plugin-rhtsupport-0:2.0.9-21.el6_6.1
  • libreport-python-0:2.0.9-21.el6_6.1