stap-server in SystemTap before 1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in stap command-line arguments in a request.

From Red Hat Security Advisory 2010:0124 :

Updated systemtap packages that fix two security issues are now available for Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

SystemTap is an instrumentation system for systems running the Linux kernel, version 2.6. Developers can write scripts to collect data on the operation of the system.

A flaw was found in the SystemTap compile server, stap-server, an optional component of SystemTap. This server did not adequately sanitize input provided by the stap-client program, which may allow a remote user to execute arbitrary shell code with the privileges of the compile server process, which could possibly be running as the root user. (CVE-2009-4273)

Note: stap-server is not run by default. It must be started by a user or administrator.

A buffer overflow flaw was found in SystemTap's tapset __get_argv() function. If a privileged user ran a SystemTap script that called this function, a local, unprivileged user could, while that script is still running, trigger this flaw and cause memory corruption by running a command with a large argument list, which may lead to a system crash or, potentially, arbitrary code execution with root privileges.
(CVE-2010-0411)

Note: SystemTap scripts that call __get_argv(), being a privileged function, can only be executed by the root user or users in the stapdev group. As well, if such a script was compiled and installed by root, users in the stapusr group would also be able to execute it.

SystemTap users should upgrade to these updated packages, which contain backported patches to correct these issues.

CVE-2009-4273 systemtap: remote code execution via stap-server

CVE-2010-0411 systemtap: Crash with systemtap script using
__get_argv()

A flaw was found in the SystemTap compile server, stap-server, an optional component of SystemTap. This server did not adequately sanitize input provided by the stap-client program, which may allow a remote user to execute arbitrary shell code with the privileges of the compile server process, which could possibly be running as the root user. (CVE-2009-4273)

Note: stap-server is not run by default. It must be started by a user or administrator.

A buffer overflow flaw was found in SystemTap's tapset __get_argv() function. If a privileged user ran a SystemTap script that called this function, a local, unprivileged user could, while that script is still running, trigger this flaw and cause memory corruption by running a command with a large argument list, which may lead to a system crash or, potentially, arbitrary code execution with root privileges.
(CVE-2010-0411)

Note: SystemTap scripts that call __get_argv(), being a privileged function, can only be executed by the root user or users in the stapdev group. As well, if such a script was compiled and installed by root, users in the stapusr group would also be able to execute it.

This update of systemtab fixes a shell meta character injection vulnerability that allows remote users to execute arbitrary commands with the privileges of the stap-server. (CVE-2009-4273)

Additionally, a remote denial of service bug in the _getargv() function has been fixed. (CVE-2010-0411)

- Add systemtap-1.1-cfi-cfa_ops-fixes.patch - Resolves     RHBZ #564429 - Add systemtap-1.1-get_argv.patch -     Resolves CVE-2010-0411 - Add systemtap-1.1
    -tighten-server-params.patch (excluding testsuite) -     Resolves CVE-2010-0412, CVE-2009-4273

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Fixes CVE-2009-4273 (Bugzilla 550172):
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2009-4273 New upstream release containing new features and bug fixes: better support for gcc 4.5 richer DWARF debuginfo, new preprocessor conditional for kernel 'CONFIG_*' testing, improved (experimental) unprivileged user support, new tapsets, better local-vs-global variable warnings, better return codes, bug fixes, and more...
http://sourceware.org/ml/systemtap/2010-q1/msg00142.html

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This updates systemtap to version 1.0. The version update was required to fix two issues; a shell meta.character injection vulnerability that allowed remote users to execute arbitrary commands () with the privileges of the stap-server. (CVE-2009-4273: CVSS v2 Base Score: 7.9 (important) (AV:A/AC:M/Au:N/C:C/I:C/A:C)) and a remote denial of service bug in the __get_argv() function (CVE-2010-0411: CVSS v2 Base Score: 4.9 (MEDIUM) (AV:L/AC:L/Au:N/C:N/I:N/A:C)). Version 1.0 is also subject to advisory CVE-2009-2911 fixing three denial of service issues when using unprivileged mode.

Updated systemtap packages that fix two security issues are now available for Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

SystemTap is an instrumentation system for systems running the Linux kernel, version 2.6. Developers can write scripts to collect data on the operation of the system.

A flaw was found in the SystemTap compile server, stap-server, an optional component of SystemTap. This server did not adequately sanitize input provided by the stap-client program, which may allow a remote user to execute arbitrary shell code with the privileges of the compile server process, which could possibly be running as the root user. (CVE-2009-4273)

Note: stap-server is not run by default. It must be started by a user or administrator.

A buffer overflow flaw was found in SystemTap's tapset __get_argv() function. If a privileged user ran a SystemTap script that called this function, a local, unprivileged user could, while that script is still running, trigger this flaw and cause memory corruption by running a command with a large argument list, which may lead to a system crash or, potentially, arbitrary code execution with root privileges.
(CVE-2010-0411)

Note: SystemTap scripts that call __get_argv(), being a privileged function, can only be executed by the root user or users in the stapdev group. As well, if such a script was compiled and installed by root, users in the stapusr group would also be able to execute it.

SystemTap users should upgrade to these updated packages, which contain backported patches to correct these issues.

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2010:0124 advisory.

  - systemtap: remote code execution via stap-server (CVE-2009-4273)

  - systemtap: Crash with systemtap script using __get_argv() (CVE-2010-0411)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
68003	Oracle Linux 5 : systemtap (ELSA-2010-0124)	Nessus	Oracle Linux Local Security Checks	critical
60742	Scientific Linux Security Update : systemtap on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	critical
50961	SuSE 11 Security Update : systemtap (SAT Patch Number 2579)	Nessus	SuSE Local Security Checks	critical
47266	Fedora 12 : systemtap-1.1-2.fc12 (2010-1720)	Nessus	Fedora Local Security Checks	critical
47250	Fedora 11 : systemtap-1.1-2.fc11 (2010-1373)	Nessus	Fedora Local Security Checks	critical
47194	Fedora 12 : systemtap-1.1-1.fc12 (2010-0688)	Nessus	Fedora Local Security Checks	critical
47193	Fedora 11 : systemtap-1.1-1.fc11 (2010-0671)	Nessus	Fedora Local Security Checks	critical
46012	openSUSE Security Update : systemtap (openSUSE-SU-2010:0166-1)	Nessus	SuSE Local Security Checks	critical
44968	CentOS 5 : systemtap (CESA-2010:0124)	Nessus	CentOS Local Security Checks	critical
44956	RHEL 5 : systemtap (RHSA-2010:0124)	Nessus	Red Hat Local Security Checks	medium

Detections

Analytics

CVE-2009-4273

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

medium