INFORMATION

Name : CVE-2009-4273 First Publication : 2010-01-26
Severity : Critical Last Modification : 2010-08-21

SCORING CVSS v2

Cvss Base Score : 10 Attack Range : Network
Cvss Impact Score : 10 Attack Complexity : Low
Cvss Expoit Score : 10 Authentification : None Required

Calculate full CVSS 2.0 Vectors scores

DETAIL

stap-server in SystemTap before 1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in stap command-line arguments in a request.



CWE COMMON WEAKNESS ENUMERATION

CWE-94 - Failure to Control Generation of Code ('Code Injection')

OVALID

oval:org.mitre.oval:def:11417, stap-server in SystemTap before 1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in stap command-line arguments in a request.

oval:org.mitre.oval:def:11414, The operating system installed on the system is Red Hat Enterprise Linux 5

CPE COMMON PLATFORM ENUMERATION


OPEN SOURCE VULNERABILTY DATABASE (OSVDB)

61806 : SystemTap stap-server Arbitrary Shell Command Execution.


SECONDARY(S) SOURCE(S)


Source : CONFIRM
Url : http://sourceware.org/bugzilla/show_bug.cgi?id=11105
Url : http://sourceware.org/systemtap/ftp/releases/systemtap-1.1.tar.gz
Url : https://bugzilla.redhat.com/show_bug.cgi?id=550172

Source : FEDORA
Url : http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035201.html
Url : http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035261.html
Url : http://lists.fedoraproject.org/pipermail/package-announce/2010-January/034036.html
Url : http://lists.fedoraproject.org/pipermail/package-announce/2010-January/034041.html

Source : MLIST
Url : http://lists.fedoraproject.org/pipermail/scm-commits/2010-February/394714.html
Url : http://sourceware.org/ml/systemtap/2010-q1/msg00142.html

Source : REDHAT
Url : http://www.redhat.com/support/errata/RHSA-2010-0124.html

Source : SECUNIA
Url : http://secunia.com/advisories/38154
Url : http://secunia.com/advisories/38216
Url : http://secunia.com/advisories/38765
Url : http://secunia.com/advisories/39656

Source : SUSE
Url : http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00006.html

Source : VUPEN
Url : http://www.vupen.com/english/advisories/2010/0169
Url : http://www.vupen.com/english/advisories/2010/1001