Abrt CVE-2015-1870 Multiple Local Information Disclosure Vulnerabilities

Bugtraq ID:	75119
Class:	Design Error
CVE:	CVE-2015-1870
Remote:	No
Local:	Yes
Published:	Jun 09 2015 12:00AM
Updated:	Aug 12 2015 10:32PM
Credit:	Florian Weimer of Red Hat.
Vulnerable:	Redhat Enterprise Linux Workstation Optional 6 Redhat Enterprise Linux Workstation 7 Redhat Enterprise Linux Workstation 6 Redhat Enterprise Linux Server Optional 6 Redhat Enterprise Linux Server 7 Redhat Enterprise Linux Server 6 Redhat Enterprise Linux HPC Node Optional 6 Redhat Enterprise Linux HPC Node 7 Redhat Enterprise Linux HPC Node 6 Redhat Enterprise Linux Desktop Optional 6 Redhat Enterprise Linux Desktop 7 Redhat Enterprise Linux Desktop 6 Oracle Enterprise Linux 7 Oracle Enterprise Linux 6.2 Oracle Enterprise Linux 6 CentOS CentOS 7 Avaya Session Border Controller for Enterprise 6.3.0 Avaya one-X Client Enablement Services 6.2 Avaya CMS R17ac.h Avaya CMS R17ac.g Avaya CMS r17 abrt abrt 0
Not Vulnerable:

Abrt CVE-2015-1870 Multiple Local Information Disclosure Vulnerabilities

Abrt is prone to multiple local information-disclosure vulnerabilities.

Local attackers can exploit these issues to obtain sensitive information. This may aid in further attacks.

Abrt CVE-2015-1870 Multiple Local Information Disclosure Vulnerabilities

References:

• Bug 1212868 - (CVE-2015-1870) CVE-2015-1870 abrt: default abrt event scripts lea (Red Hat)
  
• configure: move the default dump location to /var/spool (Abrt)
  
• make the dump directories owned by root by default (Abrt)
  
• abrt security update (RHSA-2015-1210) (Avaya)
  
• build: switch the default dump dir mode to 0640 (Abrt)
  
• RHSA-2015:1083 Important: abrt security update (Red Hat)