CVE-2015-5287

This bug lets a local attacker use a “fake file shortcut” (a symlink) in a predictable temp/spool location. If ABRT then uses that location in a privileged way, it can end up overwriting or changing files the attacker shouldn’t touch, allowing them to gain higher system privileges—up to full control.

This matters if your Linux servers run Automatic Bug Reporting Tool (ABRT) on versions before 2.7.1, including Red Hat Enterprise Linux and Enterprise Linux HPC nodes where ABRT is present. The risk is for local attackers who already have the specific permissions needed to attempt the symlink trick—this is not usually about internet-facing access. Act only if the vulnerable ABRT version is installed and the attacker can reach the predictable temp/spool paths from their local user context.

This is RED because it is confirmed as actively exploited and is listed in CISA’s Known Exploited Vulnerabilities. Attackers are using the symlink weakness to escalate privileges on systems where the vulnerable ABRT versions are present and exploitable by local users with the required permissions.

1. Identify exposure

   • Determine whether Automatic Bug Reporting Tool (ABRT) is installed on affected Linux systems.
   • Check the ABRT version in your environment; this issue affects versions before 2.7.1.

2. Confirm the vulnerable conditions (local reachability)

   • Ensure you understand which local users/groups can write to ABRT’s predictable temp/spool directories referenced by the attack paths (e.g., under /var/tmp/abrt/ and /var/spool/abrt/).
   • The exploit requires a local user with certain permissions; if only tightly controlled admins can write to those locations, the risk is reduced—but patching is still required because exploitation is known to occur.

3. Apply the fixed version

   • Upgrade ABRT to 2.7.1 or newer.
   • Use your vendor’s recommended remediation (see RHSA-2015-2505 for Red Hat Enterprise Linux paths).
   • If your environment tracks ABRT through packages, ensure the updated package set includes the commit/fix referenced by the vendor.

4. Temporary workaround if patching is delayed

   • Reduce the ability for untrusted local users to interact with ABRT’s predictable temp/spool locations.
   • Enforce permissions/ownership so that only the ABRT process and trusted administrators can create or replace entries in those directories.
   • Consider disabling ABRT functionality only if your environment’s operations can tolerate it and vendor guidance supports this approach.

5. Validate after remediation

   • Re-check ABRT is now running version 2.7.1+.
   • Confirm no vulnerable abrt-hook-ccpp behavior remains.

6. Follow CISA timeline

   • CISA KEV due date for remediation: 2026-09-09.

7. What to monitor

   • Look for signs of unexpected privilege changes or suspicious modifications to files under ABRT temp/spool paths.
   • Review for forensic/triage requirements referenced by CISA for systems in which exploitation is suspected.

Severity is high (local privilege escalation with full impact potential). The weakness is CWE-59 (symlink race condition), specifically a symlink attack on predictable temporary/spool paths used by ABRT’s abrt-hook-ccpp help program. Impact arises when the privileged process handles a predictable file path and follows a symlink created by an attacker, enabling overwriting/modifying arbitrary files and gaining elevated privileges. KEV is confirmed: it is listed in CISA’s Known Exploited Vulnerabilities with an active exploitation basis (added 2026-08-26), and news reporting indicates exploitation in the wild by an actor tracked as UAT-10147. Patch guidance is provided via Red Hat errata (RHSA-2015-2505) and an upstream ABRT commit (3c1b60cfa62d39e5fff5a53a5bc53dae189e740e). The EPSS metric is not used as a driver for urgency here because KEV/news confirm exploitation.