A race condition was found in the way abrt handled the directories used to store
information about crashes. A local attacker with the privileges of the abrt user
could use this flaw to perform a symbolic link attack, allowing them to make any
file writable by the abrt user, allowing them to escalate their privileges to
the privileged system user account, root.
This issue was assigned CVE-2012-5660.
Red Hat would like to thank Martin Carpenter of Citco for reporting this issue.
The preliminary embargo date for this issue has been set up to next Wednesday, 30-th January of 2013.
This issue affects the version of the abrt package, as shipped with Red Hat Enterprise Linux 6.
This issue affects the versions of the abrt package, as shipped with Fedora release of 16, 17 and 18.
Created abrt tracking bugs for this issue
Affects: fedora-all [bug 906280]
This issue has been addressed in following products:
Red Hat Enterprise Linux 6
Via RHSA-2013:0215 https://rhn.redhat.com/errata/RHSA-2013-0215.html