ABRT symlink privilege escalation exploited (CVE-2015-5287)

Actively exploited in the wild - CVE-2015-5287 is a high-severity privilege escalation in Automatic Bug Reporting Tool (ABRT) before 2.7.1 that lets local users with certain permissions gain root-level privileges via a symlink attack. Patched in ABRT 2.7.1 - update immediately.

Overview

CVE-2015-5287 affects the abrt-hook-ccpp helper program in ABRT, the Automatic Bug Reporting Tool used in Red Hat Enterprise Linux and Fedora distributions. The vulnerability allows a local user to exploit a symlink attack against files with predictable names in /var/tmp/abrt/ or /var/spool/abrt/ directories.

The core issue is that abrt-hook-ccpp creates core dump files using predictable names without proper security checks. An attacker with low-level permissions can pre-create a symlink at the expected location, pointing to a sensitive file they want to overwrite or manipulate. When the ABRT hook processes a crash, it writes to the symlink target, effectively letting the attacker overwrite arbitrary files on the system.

Impact

Successful exploitation grants the attacker elevated privileges, potentially escalating to root. Because the attacker only needs low-level access to the system and no user interaction is required, this vulnerability is particularly dangerous in multi-user environments or on systems where untrusted local users have accounts.

The CVSS score of 7.8 (HIGH) reflects the combination of low attack complexity and the low privileges required to trigger the flaw. The attack vector is local, meaning the attacker must already have some access to the target system.

CISA has confirmed that this vulnerability is actively exploited in the wild, and it is listed on the Known Exploited Vulnerabilities (KEV) catalog. The EPSS score of 3.4% probability of exploitation in the next 30 days indicates ongoing real-world attack activity.

Remediation

Red Hat patched this vulnerability in ABRT version 2.7.1. Organizations running affected versions should:

1. Update the abrt package to version 2.7.1 or later immediately
2. If the update cannot be applied immediately, restrict local access to only trusted users
3. Monitor /var/tmp/abrt/ and /var/spool/abrt/ directories for unexpected symlink activity
4. Audit systems for signs of prior exploitation, especially on multi-user systems

RHEL and Fedora users should check their vendor repositories for the appropriate patched packages. CentOS and other RHEL derivatives should apply the corresponding security updates as they become available.

Security Insight

This vulnerability highlights a recurring pattern in system helper utilities: predictable file paths combined with insufficient symlink validation. Attackers have used similar techniques against cron jobs, logging daemons, and package managers for years. The fact that ABRT - a tool designed to help developers debug crashes - became an attack vector demonstrates that even utility software with no network exposure can introduce significant risk. Organizations should treat local privilege escalation vulnerabilities with the same urgency as remote exploits, especially on shared infrastructure where multiple users have accounts. For more information on recent breach activity, see our breach reports and security news sections.

Further Reading

• All High Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs