SystemTap 1.0, when the --unprivileged option is used, does not properly restrict certain data sizes, which allows local users to (1) cause a denial of service or gain privileges via a print operation with a large number of arguments that trigger a kernel stack overflow, (2) cause a denial of service via crafted DWARF expressions that trigger a kernel stack frame overflow, or (3) cause a denial of service (infinite loop) via vectors that trigger creation of large unwind tables, related to Common Information Entry (CIE) and Call Frame Instruction (CFI) records.

This updates systemtap to version 1.0. The version update was required to fix two issues; a shell meta.character injection vulnerability that allowed remote users to execute arbitrary commands () with the privileges of the stap-server. (CVE-2009-4273: CVSS v2 Base Score: 7.9 (important) (AV:A/AC:M/Au:N/C:C/I:C/A:C)) and a remote denial of service bug in the __get_argv() function (CVE-2010-0411: CVSS v2 Base Score: 4.9 (MEDIUM) (AV:L/AC:L/Au:N/C:N/I:N/A:C)). Version 1.0 is also subject to advisory CVE-2009-2911 fixing three denial of service issues when using unprivileged mode.

Fixes three DOS issues in --unprivileged mode. (CVE-2009-2911)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
46012	openSUSE Security Update : systemtap (openSUSE-SU-2010:0166-1)	Nessus	SuSE Local Security Checks	critical
42281	Fedora 10 : systemtap-1.0-2.fc10 (2009-10849)	Nessus	Fedora Local Security Checks	low
42273	Fedora 11 : systemtap-1.0-2.fc11 (2009-10719)	Nessus	Fedora Local Security Checks	low

Detections

Analytics

CVE-2009-2911

medium

Tenable Plugins

critical

low

low