Untrusted search path vulnerability in plugins/abrt-action-install-debuginfo-to-abrt-cache.c in Automatic Bug Reporting Tool (ABRT) 2.0.9 and earlier allows local users to load and execute arbitrary Python modules by modifying the PYTHONPATH environment variable to reference a malicious Python module.

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2013-204:01 advisory.

    abrt: abrt is a tool to help users to detect defects in applications and to create a bug report with all     informations needed by maintainer to fix it. It uses plugin system to extend its functionality.
     libreport: Libraries providing API for reporting different problems in applications to different bug     targets like Bugzilla, ftp, trac, etc...
     btparser: Btparser is a backtrace parser and analyzer, which works with backtraces produced by the GNU     Project Debugger. It can parse a text file with a backtrace to a tree of C structures, allowing to analyze     the threads and frames of the backtrace and work with them.
    Btparser also contains some backtrace manipulation and extraction routines:
     it can find a frame in the crash-time backtrace where the program most likely crashed     (a chance is that the function described in that frame is buggy)      it can produce a duplication hash of the backtrace, which helps to discover that two     crash-time backtraces are duplicates, triggered by the same flaw of the code      it can rate the backtrace quality, which depends on the number of frames with and     without the function name known (missing function name is caused by missing debugging symbols)     Security issues fixed with this release:
     CVE-2012-5659     Untrusted search path vulnerability in plugins/abrt-action-install-debuginfo-to-abrt-cache.c in Automatic     Bug Reporting Tool (ABRT) 2.0.9 and earlier allows local users to load and execute arbitrary Python     modules by modifying the PYTHONPATH environment variable to reference a malicious Python module.
     CVE-2012-5660     abrt-action-install-debuginfo in Automatic Bug Reporting Tool (ABRT) 2.0.9 and earlier allows local users     to set world-writable permissions for arbitrary files and possibly gain privileges via a symlink attack on     the directories used to store information about crashes.
    Fixed bugs:
    abrt      more multilib fixes      rebuild because of broken brew builder      Prevent daemon from being stuck (unresponsive to socket connects) while post-create even runs      Prevent infinite loop of crashes      don't follow symlinks      fixed possible deadlock in abrt daemon      fixed relro flags      fixed the undefined weak symbols      updated translation      hopefully fixed ugly applet icon      abrt-install-ccpp-hook: fix the check for %e presense      abrt-harvest-vmcore: add CopyVMcore config option to copy vmcores.
     fixed problems discovered by brewtap      don't try to run dbus-send if it's not installed      [abrt] abrt-addon-ccpp-2.0.7-4.fc17: abrt-action-analyze-core:106:extract_info_from_core:IndexError: list     index out of range      abrt-addon-python: The process might hang forever if no one collects the dump it sends      Reporting may fail with: abrt-bodhi: command not found      too strict check for tainted kernel rhbz#814594 - abrt-ccpp status returned no status messages      abrt missing dependency: libreport-plugin-bugzilla      abrt-addon-python: The process might hang forever if no one collects the dump it sends      don't remove new problems from abrt-upload directory     libreport      rebuilding beacause of failed rpmdiff - no changes      in same cases we have to follow symlinks      don't follow symlinks      fixed relro flags      removed confusing warning message      added versioned requirements to silence rpmdiff      removed reporter-bugzilla from config file re-added by mistake      updated translation      fixed brewtap warnings      silence few rpmdiff warnings      don't show the user credentials in logs      use the default template for bz reports      fix adding users to CC in bugzilla      don't warn about daemon connection when deleting a problem      ignore non problem dirs when cleaning old problems      opt kernel out of showing smolt information in abrt bug reports.
     ABRT mailx plugin on by default causes crashes being always labelled as reported      pkg-config --cflags libreport includs -fPIC      Coverity revealed memory leaks and possibly other issues      GLib warnings by report-gtk when crash dir does not exist      `report' tool requires current working directory to be a crash dir      Searching for duplicate anaconda bugs while reporting exception against partner-bugzilla during install     fails      Undefined non-weak symbols      ABRT has wrong URL in dialog     btparser      New upstream release

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2013-0215 advisory.

    abrt     [2.0.8-6.0.1.el6_3.2]
    - Add abrt-oracle-enterprise.patch to be product neutral
    - Remove abrt-plugin-rhtsupport dependency for cli and desktop
    - Make abrt Obsoletes/Provides abrt-plugin-rhtsupprot

    [2.0.8-6.2]
    - rebuild against new libreport (brew bug)
    - Related: #895442

    [2.0.8-6.1]
    - don't follow symlinks
    - Related: #895442

    libreport     [2.0.9-5.0.1.el6_3.2]
    - Add oracle-enterprise.patch
    - Remove libreport-plugin-rhtsupport pkg

    [2.0.9-5.2]
    - in same cases we have to follow symlinks
    - Related: #895442

    [2.0.9-5.1]
    - don't follow symlinks
    - Resolves: #895442

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It was found that the /usr/libexec/abrt-action-install-debuginfo-to-abrt-cache tool did not sufficiently sanitize its environment variables. This could lead to Python modules being loaded and run from non-standard directories (such as /tmp/). A local attacker could use this flaw to escalate their privileges to that of the abrt user. (CVE-2012-5659)

A race condition was found in the way ABRT handled the directories used to store information about crashes. A local attacker with the privileges of the abrt user could use this flaw to perform a symbolic link attack, possibly allowing them to escalate their privileges to root. (CVE-2012-5660)

Updated abrt and libreport packages that fix two security issues are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

ABRT (Automatic Bug Reporting Tool) is a tool to help users to detect defects in applications and to create a bug report with all the information needed by a maintainer to fix it. It uses a plug-in system to extend its functionality. libreport provides an API for reporting different problems in applications to different bug targets, such as Bugzilla, FTP, and Trac.

It was found that the /usr/libexec/abrt-action-install-debuginfo-to-abrt-cache tool did not sufficiently sanitize its environment variables. This could lead to Python modules being loaded and run from non-standard directories (such as /tmp/). A local attacker could use this flaw to escalate their privileges to that of the abrt user. (CVE-2012-5659)

A race condition was found in the way ABRT handled the directories used to store information about crashes. A local attacker with the privileges of the abrt user could use this flaw to perform a symbolic link attack, possibly allowing them to escalate their privileges to root. (CVE-2012-5660)

Red Hat would like to thank Martin Carpenter of Citco for reporting the CVE-2012-5660 issue. CVE-2012-5659 was discovered by Miloslav Trmac of Red Hat.

All users of abrt and libreport are advised to upgrade to these updated packages, which correct these issues.

ID	Name	Product	Family	Severity
289969	MiracleLinux 4 : btparser-0.17-1.AXS4, abrt-2.0.8-15.0.1.AXS4, libreport-2.0.9-15.0.2.AXS4 (AXSA:2013-204:01)	Nessus	Miracle Linux Local Security Checks	critical
68719	Oracle Linux 6 : abrt / and / libreport (ELSA-2013-0215)	Nessus	Oracle Linux Local Security Checks	critical
64423	Scientific Linux Security Update : abrt and libreport on SL6.x i386/x86_64 (20130131)	Nessus	Scientific Linux Local Security Checks	medium
64389	RHEL 6 : abrt and libreport (RHSA-2013:0215)	Nessus	Red Hat Local Security Checks	medium
64382	CentOS 6 : abrt / libreport (CESA-2013:0215)	Nessus	CentOS Local Security Checks	medium

Detections

Analytics

CVE-2012-5659

critical

Tenable Plugins

critical

critical

medium

medium

medium