CVE-2015-5287
Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability
Description
CVE-2015-5287 is a high-severity link following vulnerability in the abrt-hook-ccpp helper program of the Automatic Bug Reporting Tool (ABRT) before version 2.7.1. ABRT writes crash dumps to files with predictable names such as /var/tmp/abrt/abrt-hax-coredump or /var/spool/abrt/abrt-hax-coredump, and a local user with certain permissions can plant a symbolic link at one of those paths so that the privileged helper writes through it to a target of the attacker's choosing — gaining privileges in the process. The flaw affects ABRT up to 2.7.0 as shipped with Red Hat Enterprise Linux 6 and 7 and Oracle Linux 7. CVE-2015-5287 carries a CVSS score of 7.8 with an EPSS score of roughly 5.0% at the 92nd percentile, public exploit code is available, and CISA added it to the Known Exploited Vulnerabilities (KEV) catalog.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| redhat | automatic bug reporting tool | <= 2.7.0 |
| oracle | linux | 7 |
| redhat | enterprise linux | 6.0; 7.0 |
| redhat | enterprise linux desktop | 7.0 |
| redhat | enterprise linux hpc node | 7.0 |
| redhat | enterprise linux server | 7.0 |
| redhat | enterprise linux workstation | 7.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/154592/ABRT-sosreport-Privilege-Escalation.html(Third Party Advisory)
- http://rhn.redhat.com/errata/RHSA-2015-2505.html(Vendor Advisory)
- http://www.openwall.com/lists/oss-security/2015/12/01/1(Exploit)
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html(Third Party Advisory)
- http://www.securityfocus.com/bid/78137(Third Party Advisory)
- https://bugzilla.redhat.com/show_bug.cgi?id=1266837(Exploit)
- https://github.com/abrt/abrt/commit/3c1b60cfa62d39e5fff5a53a5bc53dae189e740e(Patch)
- https://www.exploit-db.com/exploits/38832/(Mailing List, Third Party Advisory)
- https://blog.talosintelligence.com/uat-10147-chinese-speaking-adversary-integrates-agentic-ai-into-post-compromise-operations/(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-5287(Third Party Advisory, US Government Resource)
Weakness Type
CWE-59: Improper Link Resolution Before File Access ('Link Following')
Link following, also known as a symlink attack, occurs when software accesses a file through a path that an attacker can redirect by creating symbolic links, hard links or junctions, so a privileged process operates on a file the attacker chose rather than the one intended. In CVE-2015-5287 the abrt-hook-ccpp helper writes crash data to a predictably named file in a directory an attacker can influence, and because the path is resolved without verifying it does not traverse a link, the privileged write lands wherever the planted symlink points.
Learn more: CWE-59 — Improper Link Resolution Before File Access ('Link Following')
Impact Analysis
CVE-2015-5287 requires local access and low privileges — the advisory specifies a local user "with certain permissions", meaning an ordinary account able to write into the relevant ABRT spool directory. Attack complexity is low and no user interaction is required, and the outcome is high impact to confidentiality, integrity and availability: a privileged arbitrary file write is one of the most directly weaponisable primitives on a Linux system, typically converted into root by overwriting a file that privileged code later reads or executes, such as a cron entry, a shared library, or a configuration file. Full root means access to every file on the host, the ability to install persistence and disable logging, and on a domain-connected or key-holding server a path to credentials used elsewhere. Because ABRT is installed and enabled by default on Red Hat Enterprise Linux systems, the exposure on affected RHEL 6 and 7 and Oracle Linux 7 hosts is broad rather than niche. The EPSS score of about 5.0% in the 92nd percentile is high for a 2015 local flaw, reflecting that unpatched legacy systems are still being found and exploited.
Exploit Maturity
CVE-2015-5287 is a fully mature, publicly weaponised vulnerability. Public exploit code is available: Exploit-DB entry 38832 publishes a working exploit, the oss-security disclosure post and the Red Hat Bugzilla report are both tagged as exploit references and describe the technique in detail, and Packet Storm Security hosts related ABRT privilege escalation material. The upstream fix commit is public for diffing. CISA has confirmed active exploitation through its KEV listing, and Cisco Talos references this vulnerability in its research on UAT-10147, a Chinese-speaking adversary integrating agentic AI into post-compromise operations — evidence that it remains part of current post-compromise toolkits for legacy Linux targets. The EPSS score of roughly 5.0% in the 92nd percentile confirms sustained exploitation. Note that the SecurityFocus reference in the advisory points to a dead host; the Exploit-DB and openwall sources above are the authoritative record.
Remediation
- Follow the CISA KEV required action. Apply mitigations in accordance with Red Hat's instructions, comply with CISA's BOD 26-04 "Prioritizing Security Updates Based on Risk" guidance and the "Forensics Triage Requirements", and discontinue use of the product if mitigations are unavailable. The KEV due date of 9 September 2026 has passed.
- Update ABRT to 2.7.1 or later. All versions up to and including 2.7.0 are affected; apply Red Hat erratum RHSA-2015:2505 for Red Hat Enterprise Linux 6 and 7 — including Desktop, Server, Workstation and HPC Node variants — or Oracle's corresponding Linux 7 bulletin. The upstream fix commit documents the change.
- Disable ABRT where it is not needed. ABRT is enabled by default on Red Hat systems but is a diagnostic convenience rather than a production requirement; on servers that do not need automated crash reporting, disabling the ABRT services and hooks removes the vulnerable privileged code path entirely and reduces future exposure to the same class of bug.
- Inventory legacy Red Hat and Oracle Linux hosts. RHEL 6 and 7 and Oracle Linux 7 are long past mainstream support, so the practical challenge is finding affected systems: audit for unmanaged or forgotten hosts, appliances with embedded RHEL, and long-lived virtual machines, and prioritise multi-user systems where untrusted users hold shell access.
- Hunt for abuse and harden long term. Check
/var/tmp/abrtand/var/spool/abrtfor symbolic links and unexpected ownership, review logs for crash-handling activity that does not correspond to real application crashes, and look for modified system files and unexplained root processes; then apply the general defences for link following — ensure privileged code never opens a path in a directory writable by untrusted users without verifying the path does not traverse a link, prefer file-descriptor-based operations such asopenatwithO_NOFOLLOW, and avoid predictable filenames in shared writable directories.
Technical Details
CVE-2015-5287 is an improper link resolution before file access (CWE-59) in the abrt-hook-ccpp helper program of ABRT. When a process crashes, the kernel invokes the ABRT core dump hook, which runs with elevated privileges and writes crash data to a file whose name follows a predictable pattern — the advisory demonstrates /var/tmp/abrt/abrt-hax-coredump and /var/spool/abrt/abrt-hax-coredump. Because the filename is predictable and the containing directory is writable by, or otherwise influenceable by, a local user with certain permissions, an attacker can create a symbolic link at that path in advance. When the privileged hook then opens the path for writing without checking whether it resolves through a link, the write follows the symlink to the attacker's chosen destination, producing a privileged arbitrary file write. The CVSS vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H records a local attack with low complexity, low privileges and no user interaction, and complete impact on confidentiality, integrity and availability at unchanged scope. The two ingredients — predictable name plus attacker-influenceable directory — are the classic recipe for a symlink attack, which is why the fix combines safer file creation with verification that the target is not a link.
Frequently Asked Questions
Is CVE-2015-5287 being actively exploited?
Yes. CISA added CVE-2015-5287 to its Known Exploited Vulnerabilities catalog with a remediation due date of 9 September 2026, and Cisco Talos references it in research on the Chinese-speaking adversary UAT-10147. Public exploit code has been available on Exploit-DB since 2015, and the EPSS score of about 5.0% places it in the 92nd percentile.
What products are affected by CVE-2015-5287?
Red Hat's Automatic Bug Reporting Tool (ABRT) is affected in all versions up to and including 2.7.0, as shipped with Red Hat Enterprise Linux 6 and 7 — including Desktop, Server, Workstation and HPC Node variants — and Oracle Linux 7. Because ABRT is enabled by default on these platforms, affected hosts are exposed unless the service has been disabled.
How do I fix CVE-2015-5287?
Update ABRT to version 2.7.1 or later via Red Hat erratum RHSA-2015:2505 or Oracle's corresponding Linux 7 update. On systems that do not need automated crash reporting, disabling ABRT removes the vulnerable code path entirely; afterwards, check /var/tmp/abrt and /var/spool/abrt for planted symbolic links and review the host for signs of privilege escalation.
How severe is CVE-2015-5287?
CVE-2015-5287 is rated High with a CVSS 3.1 base score of 7.8. It needs local access and low privileges rather than remote reachability, but requires no user interaction and gives an attacker a privileged arbitrary file write — in practice a route to full root control with high confidentiality, integrity and availability impact; with public exploit code, an EPSS score in the 92nd percentile and confirmed KEV-listed exploitation, unpatched legacy systems should be treated as at immediate risk.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.