SystemTap Remote Arbitrary Command Execution Vulnerability

Bugtraq ID:	38316
Class:	Input Validation Error
CVE:	CVE-2010-0412
Remote:	No
Local:	Yes
Published:	Feb 18 2010 12:00AM
Updated:	Apr 13 2015 09:44PM
Credit:	Frank Ch. Eigler
Vulnerable:	SystemTap SystemTap 1.1
Not Vulnerable:

SystemTap Remote Arbitrary Command Execution Vulnerability

SystemTap is prone to a remote command-execution vulnerability.

Remote attackers can exploit this issue to execute arbitrary shell commands with the privileges of the user running the application.

SystemTap 1.1 is vulnerable; other versions may also be affected.

SystemTap Remote Arbitrary Command Execution Vulnerability

An attacker can exploit the issue using readily available tools.

SystemTap Remote Arbitrary Command Execution Vulnerability

Solution:
Updates are available. Please see the references for details.

SystemTap Remote Arbitrary Command Execution Vulnerability

References:

• Bug 550172 �?? CVE-2009-4273 systemtap: remote code execution via stap-server (Vincent Danen )
  
• incorrect description for CVE-2010-0412 systemtap flaw (Vincent Danen)
  
• PR11105 part 2: tighten constraints on stap-server parameters passed to make (Frank Ch. Eigler)
  
• PR11105 part 2a, fix buggy \\. in -r option regexp (Frank Ch. Eigler)
  
• SystemTap Homepage (SystemTap)